Websphere Application Server
Monthly
IBM WebSphere Application Server - Liberty (20.0.0.12 through 26.0.0.10) can be driven into a denial-of-service condition by a remote attacker whose request raises an uncaught exception, degrading availability with no confidentiality or integrity impact. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, privileges or user interaction are required - the only prerequisite is network reachability to an affected Liberty instance, and the exact endpoint or feature that triggers the fault is not described in the available sources. Exploitation has not been confirmed (CISA SSVC: Exploitation none) and no public exploit code has been identified; EPSS is low at 0.32% (23rd percentile), and the CISA SSVC assessment rates automation as possible but technical impact as partial, so prioritization within a weekly patch cycle is appropriate rather than emergency action.
Remote unauthenticated authorization bypass in IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 can let attackers reach resources or operations beyond their intended privileges, with high confidentiality and integrity impact and no availability impact. The defect is CWE-863 incorrect authorization, and the supplied sources do not describe the specific trigger, feature, or configuration involved. No public exploit identified at time of analysis; EPSS is 0.33% (24th percentile), while the vuln.today decision label is act_now and CISA SSVC records exploitation none with total technical impact.
Authentication bypass in IBM WebSphere Application Server - Liberty (17.0.0.3 through 26.0.0.10) allows remote, unauthenticated attackers to subvert the SAML 2.0 web single sign-on flow when the samlWeb-2.0 feature is explicitly enabled, resulting in a session fixation condition that yields high confidentiality and integrity impact with no availability impact (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Because samlWeb-2.0 is an opt-in Liberty feature rather than a default, only deployments that have configured SAML SSO are in scope; in practice exploitation is most credible when a legitimate user subsequently authenticates through an attacker-influenced session, which is a practical limiting factor relative to the raw vector. There is no public exploit identified at time of analysis, no confirmed active exploitation (no CISA KEV listing), and no EPSS score was supplied with the available intelligence.
Unauthenticated remote attackers can corrupt the persisted status of batch job instances on IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 via a deserialization flaw (CWE-502), rated CVSS 3.1 base 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L). Real-world exposure is limited because exploitation requires the optional, non-default Java Batch / JSR-352 batch management and persistence capability to be enabled on a network-reachable Liberty server, and the resulting impact is confined to the integrity of persisted batch state rather than full server compromise. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Access control bypass in IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 allows an unauthenticated remote attacker to call gRPC service methods while evading configured Liberty access controls. This is a genuine high-priority issue by multiple signals, with CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but practical impact is deployment-specific: it matters mainly where gRPC services are deployed and method-level access controls are relied upon. No public exploit identified at time of analysis and no CISA KEV confirmation was provided.
Improper authentication in the CSIv2 inbound propagation handler of IBM WebSphere Application Server 8.5 and 9.0 lets remote, unauthenticated attackers bypass authentication and have forged identity data accepted into the server-side security context, with high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is not trivial - it requires network reachability to the CSIv2/IIOP inbound path and a deployment that actually relies on CSIv2 inbound identity propagation, which is what the AC:H metric reflects - and no public exploit identified at time of analysis. IBM has published a vendor fix, so this is best treated as a genuine high-priority issue rather than a drop-everything emergency, with prioritization going to internet- or partner-exposed CSIv2 listeners.
Authorization bypass in IBM WebSphere Application Server 8.5 and 9.0 lets an authenticated, low-privileged user who can reach the cell's management/communication network impersonate an administrator across the entire cell. Because exploitation requires both valid credentials (CVSS PR:L, authenticated) and adjacent-network positioning (CVSS AV:A) rather than open-internet reach, this is a credible mid-to-high priority issue rather than an emergency, although a successful attack yields high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and a vendor patch is available per IBM's advisory.
Unauthenticated remote denial of service affecting IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.10) and traditional IBM WebSphere Application Server 8.5 and 9.0, where uncontrolled resource consumption lets a network-reachable attacker degrade or exhaust server availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms no authentication or user interaction is required and that impact is confined to availability, with no confidentiality or integrity loss. At the time of analysis no public exploit code has been identified for this issue, and CISA KEV does not list it as confirmed actively exploited; IBM has published a vendor fix via its support advisory at https://www.ibm.com/support/pages/node/7292214.
IBM WebSphere Application Server 8.5 and 9.0 contain improper authentication controls that allow an attacker who already holds a local, low-privileged foothold on the server to bypass security checks and escalate privileges. Successful exploitation yields high confidentiality and integrity impact — protected resources and configuration can be read and modified — though availability is unaffected per the CVSS vector. No public exploit code has been identified, EPSS is very low at 0.12% (3rd percentile), the issue is not in CISA KEV, and a vendor patch is available from IBM.
Improper privilege management in IBM WebSphere Application Server 8.5 and 9.0 lets an authenticated user who holds a low-privilege administrative role modify security configuration, resulting in information disclosure or denial of service. The flaw is remotely reachable with low complexity (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N) but requires valid administrative credentials, so it is an insider/privileged-abuse issue rather than an unauthenticated attack path. EPSS is only 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis; IBM has published a fix.
Unauthenticated remote attackers can exhaust filesystem space on IBM WebSphere Application Server 9.0 and 8.5 by sending a specially crafted HTTP request to an administrative endpoint, producing a denial-of-service condition (CVSS 7.5, availability-only). The root issue is CWE-306 - missing authentication for a critical function - meaning the administrative interface path involved does not enforce the authentication it should, and the CVSS vector explicitly carries PR:N, so no credentials or user interaction are required; the practical limiting factor is whether the administrative endpoint is network-reachable. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV, while EPSS is low at 0.22% (13th percentile), suggesting limited observed exploitation activity; a vendor patch is available per IBM's advisory.
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Liberty Continuous Delivery allows a malicious or attacker-controlled IIOP server to force a WebSphere client/server to load and instantiate arbitrary Java classes over the network. Exploitation requires no authentication or user interaction (CVSS 9.8), and successful abuse can lead to loss of confidentiality, integrity, and availability, potentially culminating in remote code execution via dangerous class instantiation. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.44% probability of exploitation in the next 30 days.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows an authenticated attacker to run arbitrary code by delivering a malicious serialized Java object through the SOAP/JMX connector, which the server deserializes unsafely (CWE-502). An attacker with low-level credentials who can reach the management connector can achieve full compromise of the application server process. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in IBM WebSphere Application Server (9.0, 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers exhaust server resources by sending a single crafted HTTP request, forcing the application server to become unresponsive. The flaw (CWE-400, uncontrolled resource consumption) carries CVSS 7.5 with a full availability impact and requires no privileges or user interaction, making it trivially reachable on any exposed HTTP listener. There is no public exploit identified at time of analysis, but a vendor patch is available from IBM.
Security constraint bypass in IBM WebSphere Application Server 8.5/9.0 (Traditional) and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 allows a remote, unauthenticated attacker to circumvent access controls and reach protected resources, resulting in disclosure of confidential information (CVSS 3.1 base 7.5, C:H). The flaw stems from an authentication-bypass-by-alternate-name weakness (CWE-289) in how the server evaluates security constraints. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.8) lets remote unauthenticated attackers coerce the server into issuing arbitrary requests when the SIP container feature (sipServlet-1.1) is enabled. The flaw carries a CVSS 9.8 rating with total technical impact, and IBM has released a fix (advisory node/7281721); no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.33%.
Unauthenticated administrative access in IBM WebSphere Application Server 9.0 and 8.5 due to broken access control allows remote attackers to gain full control of the server. The vulnerability resides in the administrative console and requires no credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. No public exploit code is known, but a vendor patch is available to remediate this critical risk.
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unauthenticated attackers to execute arbitrary code or bypass authentication. CVSS 9.8 indicates critical severity with low attack complexity and no user interaction, though no public exploit code or active exploitation has been identified at time of analysis.
Sensitive information disclosure in IBM WebSphere Application Server 8.5 and 9.0 Traditional allows a remote, unauthenticated attacker to obtain confidential data, assessed by IBM as a High-severity issue (CVSS 7.5). The root cause is CWE-532, indicating that sensitive information is inserted into log files or diagnostic output in a manner accessible to remote actors. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the CVSS vector attributes high confidentiality impact, and a vendor-released patch is available via IBM support.
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network attacker to run arbitrary code by sending crafted serialized data that the server deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 rating with a network attack vector and no authentication or user interaction required, though SSVC records exploitation as none observed and no public exploit was identified at time of analysis. EPSS is low at 0.37% (29th percentile), indicating that active, widespread exploitation has not yet materialized despite the maximal technical impact.
Denial of service in IBM WebSphere Application Server 9.0, 8.5 and Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to consume server resources via malicious HTTP requests exploiting unbounded resource allocation. This can render the service unavailable. No active exploitation or public exploit has been identified.
Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a specially crafted request and reach protected resources without valid credentials, with CVSS rating full compromise of confidentiality, integrity, and availability. The flaw stems from missing authorization enforcement (CWE-862) and carries a CVSS 9.8 requiring no user interaction or privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.31% (24th percentile) and CISA SSVC currently rates exploitation as 'none' with only partial technical impact.
HTTP response smuggling in IBM WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to poison intermediate caching proxies by exploiting improper handling of non-standard HTTP version tokens. Successful exploitation leads to high confidentiality and integrity impact through cache poisoning, potentially enabling information disclosure and malicious content injection into proxied responses. A vendor patch is available, though no public exploit code or active exploitation has been reported at this time.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7 allows remote attackers to poison request queues, potentially leading to unauthorized information disclosure and cache poisoning. The flaw stems from improper handling of TRACE requests, with a CVSS base score of 8.7 but no evidence of active exploitation or public exploit code at the time of analysis.
HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) enables remote unauthenticated attackers to poison shared HTTP connections between a front-end proxy and the application server backend. The CVSS 8.1 score reflects full confidentiality, integrity, and availability impact (C:H/I:H/A:H) but is constrained by high attack complexity (AC:H), requiring a specific proxy-to-WAS pipeline configuration to exploit. No public exploit is identified at time of analysis; EPSS is very low at 0.21% (11th percentile) and SSVC confirms no known exploitation, though technical impact is rated total.
HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 through 26.0.0.6) lets remote attackers desynchronize how front-end proxies and the WebSphere back-end parse HTTP request boundaries, enabling request-queue poisoning, security-control bypass, and disclosure of other users' data (tagged Information Disclosure). The CVSS 9.8 vector rates all impacts high, but SSVC records no observed exploitation and EPSS is low (0.34%); no public exploit is identified at time of analysis, and a vendor patch is available. Realistic exploitation depends on WebSphere sitting behind an intermediary that disagrees with it on request framing.
Arbitrary file read in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.6) lets remote attackers retrieve files from the server host when the restConnector-2.0 administrative REST feature is enabled. The flaw is classed as HTTP request smuggling (CWE-444), meaning inconsistent request parsing lets an attacker coax the server into exposing file contents it should not serve. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is low at 0.50% (39th percentile).
Server-side request forgery in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote, unauthenticated attackers coerce the server into issuing crafted requests to internal or external systems when the optional apiDiscovery-1.0 feature is enabled. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), reflecting network-reachable, no-privilege exploitation, though no public exploit is identified at time of analysis and EPSS is low at 0.19% (8th percentile). CISA SSVC scores exploitation as none and non-automatable, indicating no observed weaponization yet.
Cross-site scripting in IBM WebSphere Application Server 9.0 and 8.5 lets a remote attacker inject malicious script into the administrative console help system, which executes in the browser session of an administrator who is lured into viewing the crafted content. Because the payload runs inside an authenticated admin context, it can be abused to hijack the console session, manipulate configuration, or steal sensitive credentials. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires the victim administrator to interact with the malicious content (UI:R).
Cross-site scripting in IBM WebSphere Application Server 9.0 and 8.5 lets an attacker inject malicious script into the administrative console's integrated help system, which then executes in the browser of an administrator who views the affected page. Successful exploitation can hijack the admin session or perform actions in the console UI context. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, so risk is currently theoretical rather than actively exploited.
Directory traversal (CWE-22) in the administrative console's integrated help system of IBM WebSphere Application Server (traditional) 8.5 and 9.0 lets remote attackers read sensitive files outside the intended help-content directory, disclosing confidential information. CVSS 7.5 reflects unauthenticated network reach with high confidentiality impact but no integrity or availability effect. There is no public exploit identified at time of analysis, and the low EPSS score (0.27%, 19th percentile) plus SSVC 'Exploitation: none' indicate no observed exploitation to date.
Server-side request forgery in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers coerce the server into making arbitrary outbound requests when the adminCenter-1.0 feature is enabled. Reported by IBM PSIRT with a CVSS 3.1 base score of 9.8, the flaw carries no public exploit identified at time of analysis; EPSS is low at 0.21% (12th percentile) and CISA SSVC records exploitation status as none. The adminCenter-1.0 administrative console feature is the specific attack surface, so exposure is limited to Liberty instances that enable it.
Denial of service in IBM WebSphere Application Server 9.0 and 8.5, and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6, allows remote unauthenticated attackers to exhaust server memory by sending specially-crafted requests. CVSS 7.5 (availability-only impact) with no public exploit identified at time of analysis and a low EPSS score of 0.31% (23rd percentile). IBM has released a patch via support advisory 7276579; CISA SSVC currently rates exploitation status as 'none'.
Denial of service in IBM WebSphere Application Server 8.5 and 9.0, plus WebSphere Liberty 17.0.0.3 through 26.0.0.6, allows remote unauthenticated attackers to exhaust server memory by sending a specially crafted request. The CVSS 7.5 score reflects high availability impact with no privileges or user interaction required, though no public exploit identified at time of analysis and no EPSS or KEV data is provided.
Server-side request forgery in IBM WebSphere Application Server 8.5 and 9.0 allows remote unauthenticated attackers to coerce the server into issuing arbitrary outbound requests when the Ajax Proxy is configured, enabling security bypass and information disclosure. IBM has released fixes and no public exploit is identified at time of analysis; EPSS is low (0.23%, 14th percentile) and SSVC marks exploitation as 'none' despite a CVSS of 9.1.
HTTP request smuggling in IBM WebSphere Application Server 8.5/9.0 and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6 allows unauthenticated remote attackers to bypass security controls, spoof identities, escalate privileges, and access sensitive information. IBM has released fixes and SSVC currently rates exploitation as 'none' with EPSS at 0.35% (27th percentile), but the CVSS 9.1 rating and total technical impact warrant prompt patching given the product's enterprise footprint. No public exploit identified at time of analysis.
Authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows remote attackers to gain unauthorized access to JAX-WS web service applications without valid credentials. The CVSS 7.3 score reflects network-reachable, no-authentication exploitation with partial confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but a vendor patch is available via IBM support advisory 7276597.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows authenticated attackers to abuse unsafe Java deserialization in the SAML Web Single Sign-On component to run arbitrary code via a crafted HTTP request combined with a gadget chain. The flaw carries a CVSS 8.5 with scope change, and while no public exploit has been identified at time of analysis, deserialization gadget chains for WebSphere are historically well-researched. IBM has released a patch via support advisory node/7274733.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 arises from unsafe deserialization of untrusted data processed by JAX-WS endpoints that use WS-Security. Unauthenticated remote attackers who can reach a SOAP/JAX-WS endpoint may craft malicious serialized payloads to execute arbitrary code in the WebSphere server context. No public exploit identified at time of analysis, but the high CVSS (9.0) and scope-changed impact mean any exposed JAX-WS service is a meaningful target.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows network-based attackers to bypass security controls and execute arbitrary code on the application server. The flaw carries a CVSS 9.0 critical rating with a scope-changed impact (S:C) and requires no authentication, though high attack complexity (AC:H) suggests specific timing or environmental conditions must be met. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Identity spoofing in IBM WebSphere Application Server 9.0 and 8.5 allows remote unauthenticated attackers to impersonate legitimate users or services, leading to high-impact compromise of integrity and availability of hosted applications. The CVSS 9.1 score reflects network-reachable exploitation with low complexity and no privileges required, while no public exploit identified at time of analysis. The flaw is tracked under CWE-290 (Authentication Bypass by Spoofing) and has a vendor-released patch referenced via IBM support.
Memory-resource exhaustion in IBM WebSphere Application Server - traditional 9.0 and 8.5, plus WebSphere Application Server Liberty 19.0.0.7 through 26.0.0.5 - allows a remote, unauthenticated attacker to deny service by sending a specially crafted request (CWE-400, CVSS 7.5, impact confined to Availability:High with no confidentiality or integrity effect). Per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation requires only network reachability to an affected HTTP/application endpoint, with no authentication, user interaction, or non-default configuration identified, so default deployments appear reachable. Risk is tempered by the signals: no public exploit code and no confirmed active exploitation were identified (not in CISA KEV), EPSS is very low at 0.04% (14th percentile), and CISA SSVC rates exploitation as none with the attack assessed as not automatable, indicating the attacker must hand-craft a specific request rather than mass-scan.
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Adjacent-network attackers can drive the Name Service component of IBM WebSphere Application Server 8.5 and 9.0 into a denial-of-service condition by supplying maliciously crafted serialized data to the CORBA/IIOP naming endpoint, which the JVM then deserializes. The flaw is unauthenticated and requires no user interaction (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.5), so the practical barrier is network position rather than credentials: the attacker must be able to reach the Name Service on the same or an adjacent network segment, and default configurations leave that service listening on the network. Impact is confined to availability - no loss of confidentiality or integrity is assessed - and no public exploit code or confirmed active exploitation has been identified at time of analysis; IBM has published a vendor fix.
HTTP request smuggling in IBM WebSphere Application Server 8.5 can allow unauthenticated remote attackers to desynchronize request processing when the server sits behind or in front of an HTTP intermediary with mismatched Content-Length parsing, potentially leading to credential theft, cache poisoning, or request hijacking. The flaw (CWE-444) rates 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) and requires a specific proxy-layer mismatch and concurrent traffic; no public exploit identified at time of analysis. Vendor patch is available and the risk is assessed as moderate and non-urgent.
Missing authorization checks in the IBM WebSphere Application Server 8.5 and 9.0 administrative console allow a remote, unauthenticated attacker (per the CVSS vector PR:N) to read limited sensitive information exposed by affected console functions. The issue is rated low severity (CVSS 3.1 base 3.7, C:L/I:N/A:N) and carries a high attack complexity (AC:H), meaning the attacker must know and reach the specific console paths where checks are absent rather than sending a single trivial request. There is no public exploit identified at time of analysis, no indication of confirmed active exploitation (CISA KEV), and a vendor patch is available via IBM's advisory page.
IBM WebSphere Application Server 9.0 and 8.5 allow remote, unauthenticated attackers to obtain sensitive file-system information through the FileTransfer servlet due to incorrect authorization (CWE-863). Exploitation requires network access to the servlet endpoint, which is part of the administrative/deployment interface, and impact is limited to confidentiality (CVSS 5.3, C:L). No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available per IBM's advisory.
Unauthenticated network access to the SOAP/JMX administrative connector on IBM WebSphere Application Server 8.5 and 9.0 can bypass authentication, allowing an attacker to read limited information from the server (CWE-306, CVSS 5.3). The flaw is remotely reachable without credentials or user interaction (PR:N/UI:N/AC:L), but impact is confined to low confidentiality loss - no code execution, configuration change, or denial of service. A vendor patch is available per IBM's advisory; no public exploit has been identified at time of analysis, and real-world exposure is constrained by the fact that the SOAP/JMX connector is normally bound to a management interface that hardened deployments segment or firewall from untrusted networks.
Log injection in IBM WebSphere Application Server 9.0 and 8.5 lets remote, unauthenticated attackers corrupt server log content by supplying a crafted LTPA token cookie that the application writes to its logs without neutralizing control characters. The impact is limited to integrity (CVSS 3.1 base score 3.7, I:L) with no confidentiality or availability loss and no code execution, and exploitation is rated high complexity because the injected content must survive into the log in a form a human or downstream log consumer then misinterprets. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; a vendor patch is available per the IBM advisory.
File-system information disclosure in IBM WebSphere Application Server 9.0 and 8.5 lets an attacker positioned on an adjacent network segment query the FileTransfer servlet and learn details about the server's file system, such as file and directory names or paths. Per the vendor-supplied vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.3), the flaw is rated unauthenticated and requires no user interaction, but the adjacent-network precondition means the attacker must already sit on the same management/admin LAN or WebSphere Network Deployment segment rather than reaching the service from the open Internet, and impact is limited to low-confidentiality disclosure with no integrity or availability effect. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV; overall this is a low-priority issue, though it is notable because WebSphere is widely deployed in large enterprises.
HTTP request smuggling (CWE-444) in IBM WebSphere Application Server 8.5, 9.0, and Liberty lets an authenticated, low-privileged remote attacker desynchronize HTTP request framing between WebSphere and an intermediary so that one user's request boundaries are misattributed on a shared connection. The issue only manifests when WebSphere sits behind or in front of a second HTTP parser (reverse proxy, load balancer, or CDN) that disagrees with WebSphere on Content-Length versus Transfer-Encoding chunked handling; a standalone WebSphere instance with no fronting or backend HTTP hop is not affected, and the 4.2 score reflects high attack complexity, partial confidentiality and integrity impact, and no availability or scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available per IBM's advisory.
HTTP request smuggling in IBM WebSphere Application Server 8.5 and 9.0 (including the Liberty variant) enables unauthenticated remote attackers to manipulate shared HTTP caches, circumvent web application firewall rules, and inject malicious scripts into responses served to other users. The root cause is improper parsing of the HTTP Transfer-Encoding request header (CWE-444), a class of vulnerability that exploits disagreement between a front-end proxy and the back-end application server over where one HTTP request ends and the next begins. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Open redirect (CWE-601) in IBM WebSphere Application Server 9.0, 8.5, and Liberty enables remote attackers to conduct phishing campaigns by crafting URLs hosted on the trusted WebSphere origin that silently forward victims to attacker-controlled sites. The vulnerability requires no authentication from the attacker but does depend on social engineering to lure victims into visiting the crafted URL. Successful exploitation allows credential harvesting, further targeted attacks, or brand abuse against organizations relying on WebSphere's trusted domain reputation. No public exploit or CISA KEV listing has been identified at time of analysis.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty allows remote unauthenticated attackers to poison web caches, bypass web application firewall protections, and conduct cross-site scripting attacks by sending specially crafted Transfer-Encoding headers. The root cause is CWE-444, inconsistent interpretation of HTTP request boundaries between WebSphere and a frontend proxy component. No public exploit or confirmed active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Blind server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables authenticated remote attackers to issue arbitrary internal HTTP requests by embedding malicious URLs within crafted SOAP messages processed by the server. Although the response is not directly returned to the attacker ('blind' SSRF), an adversary can exploit timing discrepancies and error differences to map internal network topology, probe cloud instance metadata endpoints (e.g., AWS IMDSv1), or reach services otherwise inaccessible from the public internet. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Reflected cross-site scripting in IBM WebSphere Application Server 8.5 and 9.0 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted link to the vulnerable server. Successful exploitation can lead to session token theft, credential harvesting, or unauthorized actions performed under the victim's browser context. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
An authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows an attacker on an adjacent network segment to reach and invoke an administrative console servlet without valid credentials, because the servlet is missing the authorization check that should gate it (CWE-862). Successful exploitation gives low-level confidentiality and integrity exposure plus a high availability impact on the affected server. IBM has released a vendor patch, and there is no CISA KEV listing, no publicly available exploit code, and no EPSS signal in the supplied data, so the practical risk is concentrated in environments where the admin console is reachable from an untrusted adjacent network.
Authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated attacker positioned on an adjacent network segment to reach request-handling functionality that performs no authorization check (CWE-862) and read sensitive information from the response. IBM has released a vendor patch, and there is no public exploit code or CISA KEV entry associated with this issue at time of analysis, so exploitation is not confirmed actively exploited. CVSS rates it 6.5 with confidentiality-only impact and PR:N/UI:N, but no EPSS score was supplied, leaving real-world exploitation likelihood unquantified.
IBM WebSphere Application Server 9.0 and 8.5 fail to neutralize CRLF and other control characters coming from remote input before writing them into the server's administrative log, letting an unauthenticated network attacker insert forged log entries (CWE-117, improper output neutralization for logs). The CVSS 3.1 score of 5.3 reflects low integrity impact only - confidentiality and availability are unaffected and no code execution is possible - but falsified administrative logs can mask real activity and mislead incident responders. IBM has published a fix (support page node 7286610); there is no CISA KEV listing and no public exploit identified at time of analysis, though CISA's SSVC assessment marks the issue as automatable.
Authorization bypass in IBM WebSphere Application Server 8.5 and 9.0 lets an attacker positioned on an adjacent network segment reach functionality without the required authorization checks, resulting in limited (low) confidentiality exposure with no integrity or availability impact. The published CVSS 3.1 score is only 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting that exploitation demands network adjacency and a high-complexity precondition rather than an internet-facing attack. There is no CISA KEV listing, no public exploit code identified in the provided sources, and an EPSS score was not supplied; IBM has published a fix. Note the tension between the 'authorization bypass' label and the very low scored impact — the advisory's own severity framing should be verified directly against the IBM support page.
Log injection in IBM WebSphere Application Server 8.5 and 9.0 lets a remote attacker forge entries in the server's administrative log, undermining the integrity of audit records used for monitoring and forensics. The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N) and stems from improper neutralization of log output (CWE-117). IBM has published a vendor fix, and no public exploit code or CISA KEV listing was identified at time of analysis.
An authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows remote attackers to reach protected resources without valid credentials when the XD or Intelligent-Management features are in use. Successful exploitation yields unauthorized access to confidential data (C:H) with no direct integrity or availability impact, consistent with the CWE-650 (trusting HTTP permission methods) classification. IBM has published an advisory and patch (node/7286610); no public exploit code or CISA KEV listing was present in the supplied intelligence, so active exploitation is unconfirmed.
Server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables unauthenticated remote attackers to induce the server to issue arbitrary outbound HTTP requests, potentially reaching internal network resources not exposed externally. The vulnerability carries a CVSS 5.3 medium score, reflecting the constrained confidentiality impact (C:L) and absence of integrity or availability effects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though SSRF in enterprise middleware is a well-understood technique for internal network reconnaissance and cloud metadata exposure.
Remote denial-of-service in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated network attacker to degrade service availability by sending a specially crafted request that triggers uncontrolled resource consumption (CWE-400). The CVSS A:L metric indicates partial rather than complete service disruption, limiting but not eliminating operational impact. IBM has released a patch via advisory 7286610; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in IBM WebSphere Application Server traditional 8.5 and 9.0 allows remote attackers to inject arbitrary JavaScript or HTML via reflected input. A crafted link clicked by an authenticated user can execute scripts in the victim's browser, leading to session hijacking or credential theft. No active exploitation or public exploit code is currently known, and a vendor patch is available.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.8 when the restConnector-2.0 feature is enabled, allowing authenticated remote attackers with low privileges to exhaust server resources via uncontrolled recursion (CWE-674). The attack does not require user interaction and can be conducted over the network, resulting in high availability impact and potential partial confidentiality disclosure. No public exploit or active exploitation has been confirmed at time of analysis.
Stored/reflected cross-site scripting in the administrative console of IBM WebSphere Application Server 9.0 and 8.5 lets an adjacent-network attacker inject malicious script that executes in an administrator's browser session. Because the CVSS scope is changed and impact is rated high, a successful injection could let the attacker hijack the privileged admin session and pivot to broader server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Security bypass via race condition in IBM WebSphere Application Server Liberty 22.0.0.11 through 26.0.0.5 allows a remote, highly-privileged attacker to circumvent access controls during a narrow timing window, resulting in high-confidentiality-impact data exposure. The CVSS vector confirms network-based exploitation requiring high privileges and high attack complexity, constraining real-world risk significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Websphere Application Server versions up to 26.0.0.2 is affected by use of hard-coded cryptographic key (CVSS 4.7).
IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings. [CVSS 4.4 MEDIUM]
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution. [CVSS 7.6 HIGH]
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM WebSphere Application Server (WAS) versions 8.5 and 9.0 are vulnerable to remote code execution through deserialization of untrusted serialized objects, allowing unauthenticated network attackers to execute arbitrary code with high confidence despite moderate attack complexity. This is a critical Java deserialization vulnerability (CWE-502) affecting enterprise application servers in widespread use; exploitation status and EPSS probability are not yet public but the CVSS 9.0 score and network-accessible attack vector indicate this is a priority concern for organizations running affected WAS versions.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server - Liberty (20.0.0.12 through 26.0.0.10) can be driven into a denial-of-service condition by a remote attacker whose request raises an uncaught exception, degrading availability with no confidentiality or integrity impact. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, privileges or user interaction are required - the only prerequisite is network reachability to an affected Liberty instance, and the exact endpoint or feature that triggers the fault is not described in the available sources. Exploitation has not been confirmed (CISA SSVC: Exploitation none) and no public exploit code has been identified; EPSS is low at 0.32% (23rd percentile), and the CISA SSVC assessment rates automation as possible but technical impact as partial, so prioritization within a weekly patch cycle is appropriate rather than emergency action.
Remote unauthenticated authorization bypass in IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 can let attackers reach resources or operations beyond their intended privileges, with high confidentiality and integrity impact and no availability impact. The defect is CWE-863 incorrect authorization, and the supplied sources do not describe the specific trigger, feature, or configuration involved. No public exploit identified at time of analysis; EPSS is 0.33% (24th percentile), while the vuln.today decision label is act_now and CISA SSVC records exploitation none with total technical impact.
Authentication bypass in IBM WebSphere Application Server - Liberty (17.0.0.3 through 26.0.0.10) allows remote, unauthenticated attackers to subvert the SAML 2.0 web single sign-on flow when the samlWeb-2.0 feature is explicitly enabled, resulting in a session fixation condition that yields high confidentiality and integrity impact with no availability impact (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Because samlWeb-2.0 is an opt-in Liberty feature rather than a default, only deployments that have configured SAML SSO are in scope; in practice exploitation is most credible when a legitimate user subsequently authenticates through an attacker-influenced session, which is a practical limiting factor relative to the raw vector. There is no public exploit identified at time of analysis, no confirmed active exploitation (no CISA KEV listing), and no EPSS score was supplied with the available intelligence.
Unauthenticated remote attackers can corrupt the persisted status of batch job instances on IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 via a deserialization flaw (CWE-502), rated CVSS 3.1 base 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L). Real-world exposure is limited because exploitation requires the optional, non-default Java Batch / JSR-352 batch management and persistence capability to be enabled on a network-reachable Liberty server, and the resulting impact is confined to the integrity of persisted batch state rather than full server compromise. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Access control bypass in IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 allows an unauthenticated remote attacker to call gRPC service methods while evading configured Liberty access controls. This is a genuine high-priority issue by multiple signals, with CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but practical impact is deployment-specific: it matters mainly where gRPC services are deployed and method-level access controls are relied upon. No public exploit identified at time of analysis and no CISA KEV confirmation was provided.
Improper authentication in the CSIv2 inbound propagation handler of IBM WebSphere Application Server 8.5 and 9.0 lets remote, unauthenticated attackers bypass authentication and have forged identity data accepted into the server-side security context, with high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is not trivial - it requires network reachability to the CSIv2/IIOP inbound path and a deployment that actually relies on CSIv2 inbound identity propagation, which is what the AC:H metric reflects - and no public exploit identified at time of analysis. IBM has published a vendor fix, so this is best treated as a genuine high-priority issue rather than a drop-everything emergency, with prioritization going to internet- or partner-exposed CSIv2 listeners.
Authorization bypass in IBM WebSphere Application Server 8.5 and 9.0 lets an authenticated, low-privileged user who can reach the cell's management/communication network impersonate an administrator across the entire cell. Because exploitation requires both valid credentials (CVSS PR:L, authenticated) and adjacent-network positioning (CVSS AV:A) rather than open-internet reach, this is a credible mid-to-high priority issue rather than an emergency, although a successful attack yields high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and a vendor patch is available per IBM's advisory.
Unauthenticated remote denial of service affecting IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.10) and traditional IBM WebSphere Application Server 8.5 and 9.0, where uncontrolled resource consumption lets a network-reachable attacker degrade or exhaust server availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms no authentication or user interaction is required and that impact is confined to availability, with no confidentiality or integrity loss. At the time of analysis no public exploit code has been identified for this issue, and CISA KEV does not list it as confirmed actively exploited; IBM has published a vendor fix via its support advisory at https://www.ibm.com/support/pages/node/7292214.
IBM WebSphere Application Server 8.5 and 9.0 contain improper authentication controls that allow an attacker who already holds a local, low-privileged foothold on the server to bypass security checks and escalate privileges. Successful exploitation yields high confidentiality and integrity impact — protected resources and configuration can be read and modified — though availability is unaffected per the CVSS vector. No public exploit code has been identified, EPSS is very low at 0.12% (3rd percentile), the issue is not in CISA KEV, and a vendor patch is available from IBM.
Improper privilege management in IBM WebSphere Application Server 8.5 and 9.0 lets an authenticated user who holds a low-privilege administrative role modify security configuration, resulting in information disclosure or denial of service. The flaw is remotely reachable with low complexity (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N) but requires valid administrative credentials, so it is an insider/privileged-abuse issue rather than an unauthenticated attack path. EPSS is only 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis; IBM has published a fix.
Unauthenticated remote attackers can exhaust filesystem space on IBM WebSphere Application Server 9.0 and 8.5 by sending a specially crafted HTTP request to an administrative endpoint, producing a denial-of-service condition (CVSS 7.5, availability-only). The root issue is CWE-306 - missing authentication for a critical function - meaning the administrative interface path involved does not enforce the authentication it should, and the CVSS vector explicitly carries PR:N, so no credentials or user interaction are required; the practical limiting factor is whether the administrative endpoint is network-reachable. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV, while EPSS is low at 0.22% (13th percentile), suggesting limited observed exploitation activity; a vendor patch is available per IBM's advisory.
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Liberty Continuous Delivery allows a malicious or attacker-controlled IIOP server to force a WebSphere client/server to load and instantiate arbitrary Java classes over the network. Exploitation requires no authentication or user interaction (CVSS 9.8), and successful abuse can lead to loss of confidentiality, integrity, and availability, potentially culminating in remote code execution via dangerous class instantiation. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.44% probability of exploitation in the next 30 days.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows an authenticated attacker to run arbitrary code by delivering a malicious serialized Java object through the SOAP/JMX connector, which the server deserializes unsafely (CWE-502). An attacker with low-level credentials who can reach the management connector can achieve full compromise of the application server process. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in IBM WebSphere Application Server (9.0, 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers exhaust server resources by sending a single crafted HTTP request, forcing the application server to become unresponsive. The flaw (CWE-400, uncontrolled resource consumption) carries CVSS 7.5 with a full availability impact and requires no privileges or user interaction, making it trivially reachable on any exposed HTTP listener. There is no public exploit identified at time of analysis, but a vendor patch is available from IBM.
Security constraint bypass in IBM WebSphere Application Server 8.5/9.0 (Traditional) and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 allows a remote, unauthenticated attacker to circumvent access controls and reach protected resources, resulting in disclosure of confidential information (CVSS 3.1 base 7.5, C:H). The flaw stems from an authentication-bypass-by-alternate-name weakness (CWE-289) in how the server evaluates security constraints. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.8) lets remote unauthenticated attackers coerce the server into issuing arbitrary requests when the SIP container feature (sipServlet-1.1) is enabled. The flaw carries a CVSS 9.8 rating with total technical impact, and IBM has released a fix (advisory node/7281721); no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.33%.
Unauthenticated administrative access in IBM WebSphere Application Server 9.0 and 8.5 due to broken access control allows remote attackers to gain full control of the server. The vulnerability resides in the administrative console and requires no credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. No public exploit code is known, but a vendor patch is available to remediate this critical risk.
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unauthenticated attackers to execute arbitrary code or bypass authentication. CVSS 9.8 indicates critical severity with low attack complexity and no user interaction, though no public exploit code or active exploitation has been identified at time of analysis.
Sensitive information disclosure in IBM WebSphere Application Server 8.5 and 9.0 Traditional allows a remote, unauthenticated attacker to obtain confidential data, assessed by IBM as a High-severity issue (CVSS 7.5). The root cause is CWE-532, indicating that sensitive information is inserted into log files or diagnostic output in a manner accessible to remote actors. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the CVSS vector attributes high confidentiality impact, and a vendor-released patch is available via IBM support.
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network attacker to run arbitrary code by sending crafted serialized data that the server deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 rating with a network attack vector and no authentication or user interaction required, though SSVC records exploitation as none observed and no public exploit was identified at time of analysis. EPSS is low at 0.37% (29th percentile), indicating that active, widespread exploitation has not yet materialized despite the maximal technical impact.
Denial of service in IBM WebSphere Application Server 9.0, 8.5 and Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to consume server resources via malicious HTTP requests exploiting unbounded resource allocation. This can render the service unavailable. No active exploitation or public exploit has been identified.
Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a specially crafted request and reach protected resources without valid credentials, with CVSS rating full compromise of confidentiality, integrity, and availability. The flaw stems from missing authorization enforcement (CWE-862) and carries a CVSS 9.8 requiring no user interaction or privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.31% (24th percentile) and CISA SSVC currently rates exploitation as 'none' with only partial technical impact.
HTTP response smuggling in IBM WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to poison intermediate caching proxies by exploiting improper handling of non-standard HTTP version tokens. Successful exploitation leads to high confidentiality and integrity impact through cache poisoning, potentially enabling information disclosure and malicious content injection into proxied responses. A vendor patch is available, though no public exploit code or active exploitation has been reported at this time.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7 allows remote attackers to poison request queues, potentially leading to unauthorized information disclosure and cache poisoning. The flaw stems from improper handling of TRACE requests, with a CVSS base score of 8.7 but no evidence of active exploitation or public exploit code at the time of analysis.
HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) enables remote unauthenticated attackers to poison shared HTTP connections between a front-end proxy and the application server backend. The CVSS 8.1 score reflects full confidentiality, integrity, and availability impact (C:H/I:H/A:H) but is constrained by high attack complexity (AC:H), requiring a specific proxy-to-WAS pipeline configuration to exploit. No public exploit is identified at time of analysis; EPSS is very low at 0.21% (11th percentile) and SSVC confirms no known exploitation, though technical impact is rated total.
HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 through 26.0.0.6) lets remote attackers desynchronize how front-end proxies and the WebSphere back-end parse HTTP request boundaries, enabling request-queue poisoning, security-control bypass, and disclosure of other users' data (tagged Information Disclosure). The CVSS 9.8 vector rates all impacts high, but SSVC records no observed exploitation and EPSS is low (0.34%); no public exploit is identified at time of analysis, and a vendor patch is available. Realistic exploitation depends on WebSphere sitting behind an intermediary that disagrees with it on request framing.
Arbitrary file read in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.6) lets remote attackers retrieve files from the server host when the restConnector-2.0 administrative REST feature is enabled. The flaw is classed as HTTP request smuggling (CWE-444), meaning inconsistent request parsing lets an attacker coax the server into exposing file contents it should not serve. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is low at 0.50% (39th percentile).
Server-side request forgery in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote, unauthenticated attackers coerce the server into issuing crafted requests to internal or external systems when the optional apiDiscovery-1.0 feature is enabled. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), reflecting network-reachable, no-privilege exploitation, though no public exploit is identified at time of analysis and EPSS is low at 0.19% (8th percentile). CISA SSVC scores exploitation as none and non-automatable, indicating no observed weaponization yet.
Cross-site scripting in IBM WebSphere Application Server 9.0 and 8.5 lets a remote attacker inject malicious script into the administrative console help system, which executes in the browser session of an administrator who is lured into viewing the crafted content. Because the payload runs inside an authenticated admin context, it can be abused to hijack the console session, manipulate configuration, or steal sensitive credentials. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires the victim administrator to interact with the malicious content (UI:R).
Cross-site scripting in IBM WebSphere Application Server 9.0 and 8.5 lets an attacker inject malicious script into the administrative console's integrated help system, which then executes in the browser of an administrator who views the affected page. Successful exploitation can hijack the admin session or perform actions in the console UI context. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, so risk is currently theoretical rather than actively exploited.
Directory traversal (CWE-22) in the administrative console's integrated help system of IBM WebSphere Application Server (traditional) 8.5 and 9.0 lets remote attackers read sensitive files outside the intended help-content directory, disclosing confidential information. CVSS 7.5 reflects unauthenticated network reach with high confidentiality impact but no integrity or availability effect. There is no public exploit identified at time of analysis, and the low EPSS score (0.27%, 19th percentile) plus SSVC 'Exploitation: none' indicate no observed exploitation to date.
Server-side request forgery in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers coerce the server into making arbitrary outbound requests when the adminCenter-1.0 feature is enabled. Reported by IBM PSIRT with a CVSS 3.1 base score of 9.8, the flaw carries no public exploit identified at time of analysis; EPSS is low at 0.21% (12th percentile) and CISA SSVC records exploitation status as none. The adminCenter-1.0 administrative console feature is the specific attack surface, so exposure is limited to Liberty instances that enable it.
Denial of service in IBM WebSphere Application Server 9.0 and 8.5, and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6, allows remote unauthenticated attackers to exhaust server memory by sending specially-crafted requests. CVSS 7.5 (availability-only impact) with no public exploit identified at time of analysis and a low EPSS score of 0.31% (23rd percentile). IBM has released a patch via support advisory 7276579; CISA SSVC currently rates exploitation status as 'none'.
Denial of service in IBM WebSphere Application Server 8.5 and 9.0, plus WebSphere Liberty 17.0.0.3 through 26.0.0.6, allows remote unauthenticated attackers to exhaust server memory by sending a specially crafted request. The CVSS 7.5 score reflects high availability impact with no privileges or user interaction required, though no public exploit identified at time of analysis and no EPSS or KEV data is provided.
Server-side request forgery in IBM WebSphere Application Server 8.5 and 9.0 allows remote unauthenticated attackers to coerce the server into issuing arbitrary outbound requests when the Ajax Proxy is configured, enabling security bypass and information disclosure. IBM has released fixes and no public exploit is identified at time of analysis; EPSS is low (0.23%, 14th percentile) and SSVC marks exploitation as 'none' despite a CVSS of 9.1.
HTTP request smuggling in IBM WebSphere Application Server 8.5/9.0 and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6 allows unauthenticated remote attackers to bypass security controls, spoof identities, escalate privileges, and access sensitive information. IBM has released fixes and SSVC currently rates exploitation as 'none' with EPSS at 0.35% (27th percentile), but the CVSS 9.1 rating and total technical impact warrant prompt patching given the product's enterprise footprint. No public exploit identified at time of analysis.
Authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows remote attackers to gain unauthorized access to JAX-WS web service applications without valid credentials. The CVSS 7.3 score reflects network-reachable, no-authentication exploitation with partial confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but a vendor patch is available via IBM support advisory 7276597.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows authenticated attackers to abuse unsafe Java deserialization in the SAML Web Single Sign-On component to run arbitrary code via a crafted HTTP request combined with a gadget chain. The flaw carries a CVSS 8.5 with scope change, and while no public exploit has been identified at time of analysis, deserialization gadget chains for WebSphere are historically well-researched. IBM has released a patch via support advisory node/7274733.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 arises from unsafe deserialization of untrusted data processed by JAX-WS endpoints that use WS-Security. Unauthenticated remote attackers who can reach a SOAP/JAX-WS endpoint may craft malicious serialized payloads to execute arbitrary code in the WebSphere server context. No public exploit identified at time of analysis, but the high CVSS (9.0) and scope-changed impact mean any exposed JAX-WS service is a meaningful target.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows network-based attackers to bypass security controls and execute arbitrary code on the application server. The flaw carries a CVSS 9.0 critical rating with a scope-changed impact (S:C) and requires no authentication, though high attack complexity (AC:H) suggests specific timing or environmental conditions must be met. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Identity spoofing in IBM WebSphere Application Server 9.0 and 8.5 allows remote unauthenticated attackers to impersonate legitimate users or services, leading to high-impact compromise of integrity and availability of hosted applications. The CVSS 9.1 score reflects network-reachable exploitation with low complexity and no privileges required, while no public exploit identified at time of analysis. The flaw is tracked under CWE-290 (Authentication Bypass by Spoofing) and has a vendor-released patch referenced via IBM support.
Memory-resource exhaustion in IBM WebSphere Application Server - traditional 9.0 and 8.5, plus WebSphere Application Server Liberty 19.0.0.7 through 26.0.0.5 - allows a remote, unauthenticated attacker to deny service by sending a specially crafted request (CWE-400, CVSS 7.5, impact confined to Availability:High with no confidentiality or integrity effect). Per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation requires only network reachability to an affected HTTP/application endpoint, with no authentication, user interaction, or non-default configuration identified, so default deployments appear reachable. Risk is tempered by the signals: no public exploit code and no confirmed active exploitation were identified (not in CISA KEV), EPSS is very low at 0.04% (14th percentile), and CISA SSVC rates exploitation as none with the attack assessed as not automatable, indicating the attacker must hand-craft a specific request rather than mass-scan.
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Adjacent-network attackers can drive the Name Service component of IBM WebSphere Application Server 8.5 and 9.0 into a denial-of-service condition by supplying maliciously crafted serialized data to the CORBA/IIOP naming endpoint, which the JVM then deserializes. The flaw is unauthenticated and requires no user interaction (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.5), so the practical barrier is network position rather than credentials: the attacker must be able to reach the Name Service on the same or an adjacent network segment, and default configurations leave that service listening on the network. Impact is confined to availability - no loss of confidentiality or integrity is assessed - and no public exploit code or confirmed active exploitation has been identified at time of analysis; IBM has published a vendor fix.
HTTP request smuggling in IBM WebSphere Application Server 8.5 can allow unauthenticated remote attackers to desynchronize request processing when the server sits behind or in front of an HTTP intermediary with mismatched Content-Length parsing, potentially leading to credential theft, cache poisoning, or request hijacking. The flaw (CWE-444) rates 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) and requires a specific proxy-layer mismatch and concurrent traffic; no public exploit identified at time of analysis. Vendor patch is available and the risk is assessed as moderate and non-urgent.
Missing authorization checks in the IBM WebSphere Application Server 8.5 and 9.0 administrative console allow a remote, unauthenticated attacker (per the CVSS vector PR:N) to read limited sensitive information exposed by affected console functions. The issue is rated low severity (CVSS 3.1 base 3.7, C:L/I:N/A:N) and carries a high attack complexity (AC:H), meaning the attacker must know and reach the specific console paths where checks are absent rather than sending a single trivial request. There is no public exploit identified at time of analysis, no indication of confirmed active exploitation (CISA KEV), and a vendor patch is available via IBM's advisory page.
IBM WebSphere Application Server 9.0 and 8.5 allow remote, unauthenticated attackers to obtain sensitive file-system information through the FileTransfer servlet due to incorrect authorization (CWE-863). Exploitation requires network access to the servlet endpoint, which is part of the administrative/deployment interface, and impact is limited to confidentiality (CVSS 5.3, C:L). No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available per IBM's advisory.
Unauthenticated network access to the SOAP/JMX administrative connector on IBM WebSphere Application Server 8.5 and 9.0 can bypass authentication, allowing an attacker to read limited information from the server (CWE-306, CVSS 5.3). The flaw is remotely reachable without credentials or user interaction (PR:N/UI:N/AC:L), but impact is confined to low confidentiality loss - no code execution, configuration change, or denial of service. A vendor patch is available per IBM's advisory; no public exploit has been identified at time of analysis, and real-world exposure is constrained by the fact that the SOAP/JMX connector is normally bound to a management interface that hardened deployments segment or firewall from untrusted networks.
Log injection in IBM WebSphere Application Server 9.0 and 8.5 lets remote, unauthenticated attackers corrupt server log content by supplying a crafted LTPA token cookie that the application writes to its logs without neutralizing control characters. The impact is limited to integrity (CVSS 3.1 base score 3.7, I:L) with no confidentiality or availability loss and no code execution, and exploitation is rated high complexity because the injected content must survive into the log in a form a human or downstream log consumer then misinterprets. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; a vendor patch is available per the IBM advisory.
File-system information disclosure in IBM WebSphere Application Server 9.0 and 8.5 lets an attacker positioned on an adjacent network segment query the FileTransfer servlet and learn details about the server's file system, such as file and directory names or paths. Per the vendor-supplied vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.3), the flaw is rated unauthenticated and requires no user interaction, but the adjacent-network precondition means the attacker must already sit on the same management/admin LAN or WebSphere Network Deployment segment rather than reaching the service from the open Internet, and impact is limited to low-confidentiality disclosure with no integrity or availability effect. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV; overall this is a low-priority issue, though it is notable because WebSphere is widely deployed in large enterprises.
HTTP request smuggling (CWE-444) in IBM WebSphere Application Server 8.5, 9.0, and Liberty lets an authenticated, low-privileged remote attacker desynchronize HTTP request framing between WebSphere and an intermediary so that one user's request boundaries are misattributed on a shared connection. The issue only manifests when WebSphere sits behind or in front of a second HTTP parser (reverse proxy, load balancer, or CDN) that disagrees with WebSphere on Content-Length versus Transfer-Encoding chunked handling; a standalone WebSphere instance with no fronting or backend HTTP hop is not affected, and the 4.2 score reflects high attack complexity, partial confidentiality and integrity impact, and no availability or scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available per IBM's advisory.
HTTP request smuggling in IBM WebSphere Application Server 8.5 and 9.0 (including the Liberty variant) enables unauthenticated remote attackers to manipulate shared HTTP caches, circumvent web application firewall rules, and inject malicious scripts into responses served to other users. The root cause is improper parsing of the HTTP Transfer-Encoding request header (CWE-444), a class of vulnerability that exploits disagreement between a front-end proxy and the back-end application server over where one HTTP request ends and the next begins. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Open redirect (CWE-601) in IBM WebSphere Application Server 9.0, 8.5, and Liberty enables remote attackers to conduct phishing campaigns by crafting URLs hosted on the trusted WebSphere origin that silently forward victims to attacker-controlled sites. The vulnerability requires no authentication from the attacker but does depend on social engineering to lure victims into visiting the crafted URL. Successful exploitation allows credential harvesting, further targeted attacks, or brand abuse against organizations relying on WebSphere's trusted domain reputation. No public exploit or CISA KEV listing has been identified at time of analysis.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty allows remote unauthenticated attackers to poison web caches, bypass web application firewall protections, and conduct cross-site scripting attacks by sending specially crafted Transfer-Encoding headers. The root cause is CWE-444, inconsistent interpretation of HTTP request boundaries between WebSphere and a frontend proxy component. No public exploit or confirmed active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Blind server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables authenticated remote attackers to issue arbitrary internal HTTP requests by embedding malicious URLs within crafted SOAP messages processed by the server. Although the response is not directly returned to the attacker ('blind' SSRF), an adversary can exploit timing discrepancies and error differences to map internal network topology, probe cloud instance metadata endpoints (e.g., AWS IMDSv1), or reach services otherwise inaccessible from the public internet. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Reflected cross-site scripting in IBM WebSphere Application Server 8.5 and 9.0 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted link to the vulnerable server. Successful exploitation can lead to session token theft, credential harvesting, or unauthorized actions performed under the victim's browser context. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
An authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows an attacker on an adjacent network segment to reach and invoke an administrative console servlet without valid credentials, because the servlet is missing the authorization check that should gate it (CWE-862). Successful exploitation gives low-level confidentiality and integrity exposure plus a high availability impact on the affected server. IBM has released a vendor patch, and there is no CISA KEV listing, no publicly available exploit code, and no EPSS signal in the supplied data, so the practical risk is concentrated in environments where the admin console is reachable from an untrusted adjacent network.
Authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated attacker positioned on an adjacent network segment to reach request-handling functionality that performs no authorization check (CWE-862) and read sensitive information from the response. IBM has released a vendor patch, and there is no public exploit code or CISA KEV entry associated with this issue at time of analysis, so exploitation is not confirmed actively exploited. CVSS rates it 6.5 with confidentiality-only impact and PR:N/UI:N, but no EPSS score was supplied, leaving real-world exploitation likelihood unquantified.
IBM WebSphere Application Server 9.0 and 8.5 fail to neutralize CRLF and other control characters coming from remote input before writing them into the server's administrative log, letting an unauthenticated network attacker insert forged log entries (CWE-117, improper output neutralization for logs). The CVSS 3.1 score of 5.3 reflects low integrity impact only - confidentiality and availability are unaffected and no code execution is possible - but falsified administrative logs can mask real activity and mislead incident responders. IBM has published a fix (support page node 7286610); there is no CISA KEV listing and no public exploit identified at time of analysis, though CISA's SSVC assessment marks the issue as automatable.
Authorization bypass in IBM WebSphere Application Server 8.5 and 9.0 lets an attacker positioned on an adjacent network segment reach functionality without the required authorization checks, resulting in limited (low) confidentiality exposure with no integrity or availability impact. The published CVSS 3.1 score is only 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting that exploitation demands network adjacency and a high-complexity precondition rather than an internet-facing attack. There is no CISA KEV listing, no public exploit code identified in the provided sources, and an EPSS score was not supplied; IBM has published a fix. Note the tension between the 'authorization bypass' label and the very low scored impact — the advisory's own severity framing should be verified directly against the IBM support page.
Log injection in IBM WebSphere Application Server 8.5 and 9.0 lets a remote attacker forge entries in the server's administrative log, undermining the integrity of audit records used for monitoring and forensics. The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N) and stems from improper neutralization of log output (CWE-117). IBM has published a vendor fix, and no public exploit code or CISA KEV listing was identified at time of analysis.
An authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows remote attackers to reach protected resources without valid credentials when the XD or Intelligent-Management features are in use. Successful exploitation yields unauthorized access to confidential data (C:H) with no direct integrity or availability impact, consistent with the CWE-650 (trusting HTTP permission methods) classification. IBM has published an advisory and patch (node/7286610); no public exploit code or CISA KEV listing was present in the supplied intelligence, so active exploitation is unconfirmed.
Server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables unauthenticated remote attackers to induce the server to issue arbitrary outbound HTTP requests, potentially reaching internal network resources not exposed externally. The vulnerability carries a CVSS 5.3 medium score, reflecting the constrained confidentiality impact (C:L) and absence of integrity or availability effects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though SSRF in enterprise middleware is a well-understood technique for internal network reconnaissance and cloud metadata exposure.
Remote denial-of-service in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated network attacker to degrade service availability by sending a specially crafted request that triggers uncontrolled resource consumption (CWE-400). The CVSS A:L metric indicates partial rather than complete service disruption, limiting but not eliminating operational impact. IBM has released a patch via advisory 7286610; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in IBM WebSphere Application Server traditional 8.5 and 9.0 allows remote attackers to inject arbitrary JavaScript or HTML via reflected input. A crafted link clicked by an authenticated user can execute scripts in the victim's browser, leading to session hijacking or credential theft. No active exploitation or public exploit code is currently known, and a vendor patch is available.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.8 when the restConnector-2.0 feature is enabled, allowing authenticated remote attackers with low privileges to exhaust server resources via uncontrolled recursion (CWE-674). The attack does not require user interaction and can be conducted over the network, resulting in high availability impact and potential partial confidentiality disclosure. No public exploit or active exploitation has been confirmed at time of analysis.
Stored/reflected cross-site scripting in the administrative console of IBM WebSphere Application Server 9.0 and 8.5 lets an adjacent-network attacker inject malicious script that executes in an administrator's browser session. Because the CVSS scope is changed and impact is rated high, a successful injection could let the attacker hijack the privileged admin session and pivot to broader server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Security bypass via race condition in IBM WebSphere Application Server Liberty 22.0.0.11 through 26.0.0.5 allows a remote, highly-privileged attacker to circumvent access controls during a narrow timing window, resulting in high-confidentiality-impact data exposure. The CVSS vector confirms network-based exploitation requiring high privileges and high attack complexity, constraining real-world risk significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Websphere Application Server versions up to 26.0.0.2 is affected by use of hard-coded cryptographic key (CVSS 4.7).
IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings. [CVSS 4.4 MEDIUM]
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution. [CVSS 7.6 HIGH]
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM WebSphere Application Server (WAS) versions 8.5 and 9.0 are vulnerable to remote code execution through deserialization of untrusted serialized objects, allowing unauthenticated network attackers to execute arbitrary code with high confidence despite moderate attack complexity. This is a critical Java deserialization vulnerability (CWE-502) affecting enterprise application servers in widespread use; exploitation status and EPSS probability are not yet public but the CVSS 9.0 score and network-accessible attack vector indicate this is a priority concern for organizations running affected WAS versions.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.