Vulnerabilities

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

IBM

Product

Java libraries / app servers, QRadar / WebSphere / Db2 / AIX / MQ / Maximo

CVSS

9.1

EPSS

0.003 (p27)

Exposure class

Web platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-93909 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 8
   CVE NVD 18d ago

   IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught…

   CVSS 6.5 CVE-2026-95696 IBM
2. 15
   CVE NVD 18d ago

   IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect…

   CVSS 7.4 CVE-2026-95695 IBM
3. 15
   CVE NVD 18d ago

   IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status…

   CVSS 8.2 CVE-2026-93905 IBM
4. 23
   CVE NVD 18d ago

   IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls…

   CVSS 9.1 CVE-2026-93895 IBM
5. 8
   CVE NVD 18d ago

   IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system.

   CVSS 5.5 CVE-2026-79715 IBM
6. 8
   CVE NVD 18d ago

   IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks.

   CVSS 6.5 CVE-2026-77816 IBM
7. 8
   CVE NVD 18d ago

   IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an…

   CVSS 6.5 CVE-2026-14909 IBM
8. 8
   CVE NVD 18d ago

   IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an…

   CVSS 4.3 CVE-2026-14532 IBM
9. 8
   CVE NVD 18d ago

   IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0…

   CVSS 5.4 CVE-2026-11713 IBM
10. 15
    CVE NVD 18d ago

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.

    CVSS 8.2 CVE-2026-105443 IBM
11. 15
    CVE NVD 18d ago

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker…

    CVSS 8.7 CVE-2026-101294 IBM