WebSphere Application Server Liberty vulnerabilities

Product

WebSphere Application Server Liberty

by IBM · last CVE Oct 13, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities60 In the news0 Timeline

Severity mix

Critical 13High 28Medium 19Low 0

Severity

All severities60 Critical13 High28 Medium19 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-14980	8.8	0%	Jul 30	IBM WebSphere Application Server Liberty is affected by a cross-site request forgery Affected: 17.0.0.3 through 26.0.0.8
CVE-2026-2482	8.8	0%	Jul 29	IBM WebSphere Application Server Liberty is affected by a cross-site request forgery Affected: 17.0.0.3 through 26.0.0.8
CVE-2026-101294	8.7	0%	Oct 13	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step Affected: 17.0.0.3 through 26.0.0.10
CVE-2026-15064	8.7	0%	Jul 28	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 17.0.0.3 through 26.0.0.7
CVE-2026-15325	8.7	0%	Jul 28	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 17.0.0.3 through 26.0.0.7
CVE-2026-93905	8.2	0%	Oct 13	IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data Affected: 17.0.0.3 through 26.0.0.10
CVE-2026-105443	8.2	0%	Oct 13	IBM WebSphere Application Server Liberty is affected by an improper access control Affected: 17.0.0.3 through 26.0.0.10
CVE-2026-18499	8.1	0%	Aug 12	IBM WebSphere Application Server Liberty is affected by a privilege escalation Affected: 17.0.0.3 through 26.0.0.8
CVE-2026-15328	8.1	0%	Jul 28	IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests Affected: 17.0.0.3 through 26.0.0.7
CVE-2026-95696	7.5	0%	Oct 13	IBM WebSphere Application Server Liberty Denial of Service Affected: 20.0.0.12 through 26.0.0.10
CVE-2026-105442	7.5	0%	Oct 13	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data Affected: 17.0.0.3 through 26.0.0.10
CVE-2026-103499	7.5	0%	Oct 13	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service Affected: 17.0.0.3 through 26.0.0.10
CVE-2026-9322	7.5	1%	Jul 30	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 17.0.0.3 through 26.0.0.7
CVE-2026-10842	7.5	1%	Jul 30	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability Affected: 17.0.0.3 through 26.0.0.7
CVE-2026-11897	7.5	1%	Jul 30	IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 Affected: 17.0.0.3 through 26.0.0.7
CVE-2026-14981	7.5	0%	Jul 28	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 17.0.0.3 through 26.0.0.7
CVE-2026-15057	7.5	0%	Jul 28	IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability Affected: 17.0.0.3 through 26.0.0.7
CVE-2026-15280	7.5	1%	Jul 28	IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability Affected: 17.0.0.3 through 26.0.0.8
CVE-2026-11806	7.5	0%	Jun 30	IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability Affected: 17.0.0.3 through 26.0.0.6
CVE-2026-9320	7.5	1%	Jun 22	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 17.0.0.3 through 26.0.0.6
CVE-2026-9071	7.5	1%	Jun 22	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption Affected: 17.0.0.3 through 26.0.0.6
CVE-2026-4410	7.5	0%	May 27	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service Affected: 19.0.0.7 through 26.0.0.5
CVE-2024-25026	7.5	1%	Apr 25	IBM WebSphere Application Server denial of service Affected: 17.0.0.3 through 24.0.0.4
CVE-2024-27268	7.5	1%	Apr 4	IBM WebSphere Application Server Liberty denial of service Affected: 18.0.0.2 through 24.0.0.4
CVE-2024-22353	7.5	1%	Mar 31	IBM WebSphere Application Server Liberty denial of service Affected: 17.0.0.3 through 24.0.0.4
CVE-2023-38737	7.5	1%	Aug 16	IBM WebSphere Application Server Liberty denial of service Affected: 22.0.0.13 through 23.0.0.7
CVE-2025-14915	7.2	1%	Mar 25	IBM WebSphere Application Server Liberty is affected by a privilege escalation vulnerability Affected: 17.0.0.3 through 26.0.0.3
CVE-2024-22354	7.0	1%	Apr 17	IBM WebSphere Application Server XML external entity injection Affected: 17.0.0.3 through 24.0.0.5; cpe:2.3:a:ibm:websphere_application_server:17.0.0.3::::liberty:::; cpe:2.3:a:ibm:websphere_application_server:24.0.0.5::::liberty:::