CVE-2026-105442: CWE-502 Deserialization of Untrusted Data in IBM WebSphere Application Server

This vulnerability (CWE-502) affects IBM WebSphere Application Server 8.5, 9.0, and Liberty versions 17.0.0.3 through 26.0.0.10. It arises from insecure deserialization of untrusted data within the messaging service component, enabling a remote attacker to trigger a denial of service condition. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). There is no indication of confidentiality or integrity compromise. The vulnerability is published and assigned by IBM, but no patch or remediation details are provided in the input data.

An attacker can remotely cause a denial of service in affected IBM WebSphere Application Server instances by exploiting insecure deserialization in the messaging service. This disrupts availability but does not affect confidentiality or integrity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's security advisories for updates. Until a fix is available, consider restricting network access to the messaging service to trusted sources to reduce exposure.