IBM WebSphere vulnerabilities and fixes

CVEs that mention IBM WebSphere, ranked by priority. 29 tracked.

IBM WebSphere has 29 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 26. Most recent: 2026-10-13. Highest priority: CVE-2026-14512 (score 58/100).

• CVE-2026-14512 CRITICAL 9.8 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deseriali
• CVE-2026-14446 CRITICAL 9.8 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in t
• CVE-2026-14974 HIGH 8.1 UPGRADE IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary c
• CVE-2026-93895 CRITICAL 9.1 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote a
• CVE-2026-93909 CRITICAL 9.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypas
• CVE-2026-11536 HIGH 8.5 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP
• CVE-2026-11897 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, cau
• CVE-2026-15280 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a
• CVE-2026-15057 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due
• CVE-2026-11707 CRITICAL 9.3 UPGRADE UPGRADE IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cro
• CVE-2026-14528 HIGH 7.4 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive in
• CVE-2026-16184 HIGH 7.0 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sendin
• CVE-2026-93905 HIGH 8.2 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote at
• CVE-2026-14980 HIGH 8.3 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forge
• CVE-2026-14976 HIGH 7.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with
• CVE-2026-18499 HIGH 8.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation w
• CVE-2026-95695 HIGH 7.4 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass
• CVE-2026-95696 MEDIUM 6.5 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause
• CVE-2026-15396 MEDIUM 6.5 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
• CVE-2026-15412 MEDIUM 6.5 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
• CVE-2026-15634 MEDIUM 6.5 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
• CVE-2026-16192 HIGH 7.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulner
• CVE-2026-11549 MEDIUM 6.5 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
• CVE-2026-14515 MEDIUM 6.1 UPGRADE IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-sit
• CVE-2026-10841 MEDIUM 4.8 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
• CVE-2026-11548 MEDIUM 4.8 IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 thro
• CVE-2026-11722 MEDIUM 4.8 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
• CVE-2026-11383 MEDIUM 5.4 UPGRADE UPGRADE IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross
• CVE-2026-2482 LOW 3.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forge

FAQ

How do I fix IBM WebSphere vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is IBM WebSphere being exploited right now?

None of the tracked IBM WebSphere CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which IBM WebSphere CVE should I patch first?

CVE-2026-14512 currently ranks highest (58/100): IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deseriali.

← Back to latest CVEs