Threats affecting pkg:maven/com.ibm.websphere/websphere-application-server

CVE-2026-101294 is a high-severity vulnerability in IBM WebSphere Application Server - Liberty and IBM WebSphere Application Server versions 8.5 and 9.0. It involves a missing cryptographic step that allows a remote attacker to bypass cryptographic signature verification due to improper verification of the cryptographic signature. This flaw affects versions 17.0.0.3 through 26.0.0.10 of WebSphere Application Server - Liberty and versions 8.5 and 9.0 of WebSphere Application Server. The vulnerability has a CVSS 3.1 score of 8.7, indicating a high impact on confidentiality and integrity without requiring privileges or user interaction. No patch or remediation information is provided in the available data.

CVE-2026-105442 is a high-severity vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, and Liberty editions from 17.0.0.3 through 26.0.0.10. It involves insecure deserialization of untrusted data in the messaging service, which could allow a remote attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability.

IBM WebSphere Application Server versions 8.5 and 9.0 contain an authentication bypass vulnerability in the CSIv2 inbound propagation handler. This flaw allows a remote attacker to bypass authentication mechanisms, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is identified as CWE-287 (Improper Authentication) and has a high severity with a CVSS score of 8.1.

CVE-2026-95680 is a high-severity vulnerability in IBM WebSphere Application Server versions 8.5 and 9.0. It involves improper authentication (CWE-287) that could allow an authenticated attacker to bypass authorization controls, potentially leading to administrative impersonation across the server cell. This could result in full compromise of administrative functions. The vulnerability has a CVSS 3.1 score of 8.0, indicating a significant risk. No vendor patch or remediation details are provided in the available data.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.

IBM WebSphere Application Server versions 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.5 are affected by an HTTP request smuggling vulnerability. This issue arises from improper parsing of the HTTP transfer-encoding request header. Exploitation could allow attackers to poison web caches, bypass web application firewalls, and conduct cross-site scripting (XSS) attacks. The vulnerability has a medium severity with a CVSS score of 6.5.

CVE-2026-15412 is an open redirect vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.5. This flaw allows remote attackers to craft URLs that redirect users to malicious websites, potentially enabling phishing attacks by spoofing trusted URLs. The vulnerability could lead to unauthorized disclosure of sensitive information or facilitate further attacks on victims.

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests.

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet.

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request.

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.

CVE-2026-9327 is a vulnerability in IBM WebSphere Application Server versions 8.5 and 9.0 where an authenticated user with a low-privilege administrative role can modify security configurations. This improper privilege management flaw could lead to denial of service but does not impact confidentiality or integrity.

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space.

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumption, potentially leading to reduced availability of the affected service.

IBM WebSphere Application Server versions 8.5, 9.0, and Liberty versions 17.0.0.3 through 26.0.0.7 have a vulnerability that could allow a remote attacker to bypass security constraints. This issue affects both Traditional and Liberty editions. The vulnerability is classified under CWE-289, indicating improper authentication. No specific patch or remediation information is provided in the available data.

CVE-2026-9322 is a high-severity vulnerability in IBM WebSphere Application Server versions 9.0, 8.5, and Liberty releases from 17.0.0.3 through 26.0.0.7. It allows denial of service (DoS) via crafted HTTP requests that cause uncontrolled resource consumption.

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.