Vulnerability details

CVE-2026-93895

IBM WebSphere Application Server - Liberty

IBM WebSphere Application Server Liberty Improper Access Control

CVSS 3.1

9.1Critical

Official description

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.

CVSS scores

Score	Version	Source	Vector
9.1Critical	3.1	CVEProject cvelistV5 (CNA) (ibm)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
IBM	WebSphere Application Server - Liberty	20.0.0.12 ≤ v ≤ 26.0.0.10	CVEProject cvelistV5 (CNA)

References and advisories

https://www.ibm.com/support/pages/node/7292228 vendor-advisorypatch

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-13
Last updated: 2026-10-17
State: Published
Assigner (CNA): ibm
Kolun priority: 22 · Low

Exploit prediction (EPSS)

0.39%

Probability of exploitation in 30 days

33.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-284
Improper Access Control