Skip to main content

WebSphere Liberty CVE-2026-18499

| EUVDEUVD-2026-57322 HIGH
Improper Authorization (CWE-285)
2026-08-12 ibm GHSA-fg2c-rf98-x93f
Privilege Escalation Authentication Bypass IBM Websphere Application Server Liberty
8.1
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
8.1 HIGH

Network-exploitable via collective management plane; low privilege required for authenticated collective access; no availability impact from privilege escalation alone.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 12, 2026 - 17:07 vuln.today
CVE Published
Aug 12, 2026 - 16:25 cve.org
HIGH 8.1

DescriptionCVE.org

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.

AnalysisAI

Privilege escalation in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 allows an authenticated low-privileged user to gain unauthorized access to protected data and functionality when the Liberty collectives feature is in use. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable, low-complexity exploitation requiring only low-level authentication with no user interaction - resulting in high confidentiality and integrity impact. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege collective credentials
Delivery
Authenticate to Liberty collective controller over network
Exploit
Submit crafted management request targeting authorization check
Execution
Trigger CWE-285 improper authorization bypass
Persist
Escalate to higher-privilege collective role
Impact
Access or modify protected application data and configurations
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The Liberty collectives feature must be configured and active on the target IBM WebSphere Application Server - Liberty instance - standalone Liberty deployments not using collectives are not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.1 High score is substantiated by the vector metrics: network-accessible (AV:N), low complexity (AC:L), requiring only low-level authentication (PR:L), no user interaction (UI:N), with high confidentiality and integrity impact (C:H/I:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained valid low-privilege credentials for a Liberty collective environment - through phishing, credential reuse, or an insider threat - authenticates to the collective controller and submits crafted management requests that exploit the improper authorization flaw (CWE-285). By bypassing role enforcement checks, the attacker escalates to a higher privilege level within the collective, gaining the ability to read sensitive application configuration, data, or secrets, and to modify collective member server configurations. …
Remediation Apply the vendor-released patch per IBM Security Bulletin at https://www.ibm.com/support/pages/node/7283489. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all IBM WebSphere Liberty deployments running versions 17.0.0.3 through 26.0.0.8, with particular focus on systems with the Liberty collectives feature enabled. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Websphere Application Server Liberty

View all
CVE-2026-8400 CRITICAL
9.8 Aug 05

Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Libe
CVE-2026-11541 CRITICAL
9.8 Jun 30

HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 thr
CVE-2026-14529 CRITICAL
9.8 Jul 29

Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Serv
CVE-2026-14976 CRITICAL
9.8 Jul 28

Remote code execution in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows unauthenti
CVE-2023-46158 CRITICAL
9.8 Oct 25

IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to i
CVE-2026-14525 CRITICAL
9.4 Aug 13

Authentication bypass in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows remote att
CVE-2026-8646 CRITICAL
9.1 Jun 22

HTTP request smuggling in IBM WebSphere Application Server 8.5/9.0 and WebSphere Application Server Liberty 17.0.0.3 thr
CVE-2026-14980 HIGH
8.8 Jul 30

Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side r
CVE-2026-15064 HIGH
8.7 Jul 28

HTTP response smuggling in IBM WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7 all
CVE-2026-15325 HIGH
8.7 Jul 28

HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7 allows remote
CVE-2026-15328 HIGH
8.1 Jul 28

HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liber
CVE-2026-15280 HIGH
7.5 Jul 28

Information disclosure in IBM WebSphere Liberty ND Collective Controller, versions 17.0.0.3 through 26.0.0.8, allows rem

Same weakness CWE-285 – Improper Authorization

View all
CVE-2025-29927 CRITICAL POC
9.1
CVE-2016-5676 HIGH POC
7.5
CVE-2025-66301 CRITICAL POC
9.6
CVE-2023-32707 HIGH POC
8.8
CVE-2016-3352 HIGH
8.8
CVE-2025-29659 CRITICAL POC
9.8
CVE-2022-2595 CRITICAL POC
10.0
CVE-2026-30956 CRITICAL POC
9.9

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2026-18499 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy