PatchTheCVEwebsphere application server vulnerabilities and fixes
Recent CVEs affecting websphere application server, with upgrade or downgrade steps. 22 tracked.
Also searched as: websphereapplicationserver.
websphere application server has 22 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 22. Most recent: 2026-10-13. Highest priority: CVE-2026-14512 (score 58/100).
- CVE-2026-2482 LOW 3.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forge
- CVE-2026-14512 CRITICAL 9.8 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deseriali
- CVE-2026-14446 CRITICAL 9.8 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in t
- CVE-2026-14974 HIGH 8.1 UPGRADE IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary c
- CVE-2026-15280 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a
- CVE-2026-15057 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due
- CVE-2026-16184 HIGH 7.0 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sendin
- CVE-2026-14528 HIGH 7.4 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive in
- CVE-2026-14976 HIGH 7.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with
- CVE-2026-16192 HIGH 7.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulner
- CVE-2026-14515 MEDIUM 6.1 UPGRADE IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-sit
- CVE-2026-11897 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, cau
- CVE-2026-11536 HIGH 8.5 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP
- CVE-2026-11707 CRITICAL 9.3 UPGRADE UPGRADE IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cro
- CVE-2026-14980 HIGH 8.3 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forge
- CVE-2026-11383 MEDIUM 5.4 UPGRADE UPGRADE IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross
- CVE-2026-18499 HIGH 8.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation w
- CVE-2026-93909 CRITICAL 9.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypas
- CVE-2026-93905 HIGH 8.2 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote at
- CVE-2026-93895 CRITICAL 9.1 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote a
- CVE-2026-95695 HIGH 7.4 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass
- CVE-2026-95696 MEDIUM 6.5 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause
FAQ
How do I fix websphere application server vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is websphere application server being exploited right now?
None of the tracked websphere application server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which websphere application server CVE should I patch first?
CVE-2026-14512 currently ranks highest (58/100): IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deseriali.