CVE-2026-105442: IBM WebSphere Application Server insecure deserialization in messaging

CVE-2026-105442 · Severity: high · CVSS 7.5 · Published 2026-10-13

IBM WebSphere Application Server is a Java-based application platform used to run critical business applications. A vulnerability in the messaging service allows remote attackers to send malicious messages that crash the application server, causing service outages without requiring authentication or user interaction.

Technologies: IBM WebSphere Application Server, IBM WebSphere Application Server Liberty. Vendors: IBM.

Quick answers

Is CVE-2026-105442 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105442 being exploited in the wild.
How severe is CVE-2026-105442?
High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?
IBM WebSphere Application Server 8.5, 9.0; IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10.
Is there a fix for CVE-2026-105442?
Yes: fixed in WebSphere Application Server Liberty 26.0.0.11 or later; WebSphere Application Server 9.0.5.30 or later; WebSphere Application Server 8.5.5.32 or later. Interim fixes resolving APAR DT503516 or DT503624 also available.. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105442 attacked?
It is attacked over the network.
Am I affected by CVE-2026-105442?
Check whether you run IBM WebSphere Application Server or IBM WebSphere Application Server Liberty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: WebSphere Application Server Liberty 26.0.0.11 or later; WebSphere Application Server 9.0.5.30 or later; WebSphere Application Server 8.5.5.32 or later. Interim fixes resolving APAR DT503516 or DT503624 also available.

Technical details

The vulnerability is an insecure deserialization flaw (CWE-502) in the messaging service component of WebSphere Application Server and Liberty. Remote attackers can exploit this over the network without authentication to trigger a denial of service condition. The fix is available via interim fixes or upcoming fix packs.

Affected products

  • IBM WebSphere Application Server 8.5, 9.0
  • IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10

Timeline

  • 2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.