# IBM WebSphere Application Server Liberty vulnerabilities Source: https://junglewise.ai/threats/technologies/websphere-application-server-liberty Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/websphere-application-server-liberty.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 56 vulnerabilities in IBM WebSphere Application Server Liberty: 5 in the last 7 days and 26 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-78636, was published on 8 November 2026. 19 vulnerabilities in the last four weeks, up 171% on the four before (7). 2 critical against 0. ## Counts - Last 7 days: 5 - Last 30 days: 5 - Last 90 days: 26 - All time: 56 (3 critical, 0 exploited in the wild) ## About IBM WebSphere Application Server Liberty IBM's lightweight application server for running Java applications in cloud and containerized environments. ## Latest IBM WebSphere Application Server Liberty vulnerabilities - [CVE-2026-78636: IBM WebSphere Application Server Liberty information disclosure in JMX REST connector](https://junglewise.ai/threats/cve-2026-78636-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-11547: IBM WebSphere Application Server Liberty server-side request forgery in Admin Center](https://junglewise.ai/threats/cve-2026-11547-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-10844: IBM WebSphere Application Server Liberty open redirect](https://junglewise.ai/threats/cve-2026-10844-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-108284: IBM WebSphere Application Server Liberty information disclosure](https://junglewise.ai/threats/cve-2026-108284-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (medium, CVSS 6.5, published 8 Nov 2026) - [CVE-2026-103320: IBM WebSphere Application Server Liberty information disclosure](https://junglewise.ai/threats/cve-2026-103320-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-95696: IBM WebSphere Application Server Liberty denial of service via uncaught exception](https://junglewise.ai/threats/cve-2026-95696-ibm-websphere-application-server-liberty-20-0-0-12-through-26-0-0) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-95695: IBM WebSphere Application Server Liberty incorrect authorization in gRPC](https://junglewise.ai/threats/cve-2026-95695-ibm-websphere-application-server-liberty-20-0-0-12-through-26-0-0) (high, CVSS 7.4, published 13 Oct 2026) - [CVE-2026-93909: IBM WebSphere Application Server Liberty authentication bypass in samlWeb-2.0](https://junglewise.ai/threats/cve-2026-93909-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-93905: IBM WebSphere Application Server Liberty deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-93905-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (high, CVSS 8.2, published 13 Oct 2026) - [CVE-2026-93895: IBM WebSphere Application Server Liberty gRPC access control bypass](https://junglewise.ai/threats/cve-2026-93895-ibm-websphere-application-server-liberty-20-0-0-12-through-26-0-0) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-79715: IBM WebSphere Application Server Liberty path traversal](https://junglewise.ai/threats/cve-2026-79715-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (medium, CVSS 5.5, published 13 Oct 2026) - [CVE-2026-77816: IBM WebSphere Application Server Liberty improper certificate validation](https://junglewise.ai/threats/cve-2026-77816-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-14909: IBM WebSphere Application Server Liberty information disclosure in restConnector](https://junglewise.ai/threats/cve-2026-14909-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-14532: IBM WebSphere Application Server Liberty information disclosure](https://junglewise.ai/threats/cve-2026-14532-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-11713: IBM WebSphere Application Server Liberty privilege escalation in restConnector](https://junglewise.ai/threats/cve-2026-11713-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-105443: IBM WebSphere Application Server Liberty improper access control](https://junglewise.ai/threats/cve-2026-105443-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (high, CVSS 8.2, published 13 Oct 2026) - [CVE-2026-105442: IBM WebSphere Application Server insecure deserialization in messaging](https://junglewise.ai/threats/cve-2026-105442-ibm-websphere-application-server-8-5-and-9-0-and-ibm-websphere) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-101294: IBM WebSphere Application Server cryptographic signature verification bypass](https://junglewise.ai/threats/cve-2026-101294-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (high, CVSS 8.7, published 13 Oct 2026) - [CVE-2026-103499: IBM WebSphere Application Server denial of service via resource consumption](https://junglewise.ai/threats/cve-2026-103499-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-11722: IBM WebSphere Application Server HTTP request smuggling](https://junglewise.ai/threats/cve-2026-11722-ibm-websphere-application-server-and-websphere-application-server) (medium, CVSS 4.8, published 18 Sep 2026) - [CVE-2026-11549: IBM WebSphere Application Server virtual host bypass](https://junglewise.ai/threats/cve-2026-11549-ibm-websphere-application-server-and-websphere-application-server) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-11548: IBM WebSphere Application Server HTTP request smuggling](https://junglewise.ai/threats/cve-2026-11548-ibm-websphere-application-server-and-websphere-application-server) (medium, CVSS 4.8, published 18 Sep 2026) - [CVE-2026-10841: IBM WebSphere Application Server HTTP request smuggling](https://junglewise.ai/threats/cve-2026-10841-ibm-websphere-application-server-http-request-smuggling) (medium, CVSS 4.2, published 18 Sep 2026) - [CVE-2026-15634: IBM WebSphere Application Server HTTP request smuggling via transfer-encoding header](https://junglewise.ai/threats/cve-2026-15634-ibm-websphere-application-server-http-request-smuggling-via) (medium, CVSS 6.5, published 14 Sep 2026) - [CVE-2026-15412: IBM WebSphere Application Server open redirect phishing attack](https://junglewise.ai/threats/cve-2026-15412-ibm-websphere-application-server-open-redirect-phishing-attack) (medium, CVSS 6.5, published 14 Sep 2026) ## Most severe IBM WebSphere Application Server Liberty vulnerabilities - [CVE-2026-14529: IBM WebSphere Application Server SSRF in SIP container](https://junglewise.ai/threats/cve-2026-14529-ibm-websphere-application-server-ssrf-in-sip-container) (critical, CVSS 9.4, published 29 Jul 2026) - [CVE-2026-93895: IBM WebSphere Application Server Liberty gRPC access control bypass](https://junglewise.ai/threats/cve-2026-93895-ibm-websphere-application-server-liberty-20-0-0-12-through-26-0-0) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-93909: IBM WebSphere Application Server Liberty authentication bypass in samlWeb-2.0](https://junglewise.ai/threats/cve-2026-93909-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-101294: IBM WebSphere Application Server cryptographic signature verification bypass](https://junglewise.ai/threats/cve-2026-101294-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (high, CVSS 8.7, published 13 Oct 2026) - [CVE-2026-15325: IBM WebSphere Application Server HTTP request smuggling in TRACE requests](https://junglewise.ai/threats/cve-2026-15325-ibm-websphere-application-server-http-request-smuggling-in-trace) (high, CVSS 8.7, published 28 Jul 2026) - [CVE-2026-15064: IBM WebSphere Application Server HTTP response smuggling](https://junglewise.ai/threats/cve-2026-15064-ibm-websphere-application-server-http-response-smuggling) (high, CVSS 8.7, published 28 Jul 2026) - [CVE-2026-11714: IBM WebSphere Application Server Liberty SSRF in apiDiscovery-1.0](https://junglewise.ai/threats/cve-2026-11714-ibm-websphere-application-server-liberty-ssrf-in-apidiscovery-1-0) (high, CVSS 8.5, published 30 Jun 2026) - [CVE-2026-14980: IBM WebSphere Application Server Liberty CSRF in collectiveController](https://junglewise.ai/threats/cve-2026-14980-ibm-websphere-application-server-liberty-csrf-in) (high, CVSS 8.3, published 30 Jul 2026) - [CVE-2026-93905: IBM WebSphere Application Server Liberty deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-93905-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (high, CVSS 8.2, published 13 Oct 2026) - [CVE-2026-105443: IBM WebSphere Application Server Liberty improper access control](https://junglewise.ai/threats/cve-2026-105443-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (high, CVSS 8.2, published 13 Oct 2026) ## Vulnerabilities per week 19 vulnerabilities in the last four weeks, up 171% on the four before (7). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 7 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 14 | 2 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 5 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other IBM technologies - [IBM API Connect](https://junglewise.ai/threats/technologies/api-connect): 207 vulnerabilities - [IBM AIX](https://junglewise.ai/threats/technologies/aix): 181 vulnerabilities - [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss): 154 vulnerabilities - [IBM i](https://junglewise.ai/threats/technologies/i): 120 vulnerabilities - [IBM Guardium Data Protection](https://junglewise.ai/threats/technologies/guardium-data-protection): 93 vulnerabilities - [IBM PowerVM VIOS](https://junglewise.ai/threats/technologies/powervm-vios): 73 vulnerabilities - [IBM Vios](https://junglewise.ai/threats/technologies/vios): 72 vulnerabilities - [IBM WebSphere Application Server](https://junglewise.ai/threats/technologies/websphere-application-server): 67 vulnerabilities - [IBM Verify Identity Access](https://junglewise.ai/threats/technologies/verify-identity-access): 50 vulnerabilities - [IBM Datastage On Cloud Pak For Data](https://junglewise.ai/threats/technologies/datastage-on-cloud-pak-for-data): 48 vulnerabilities - [IBM Mq](https://junglewise.ai/threats/technologies/mq): 46 vulnerabilities - [IBM Financial Transaction Manager](https://junglewise.ai/threats/technologies/financial-transaction-manager): 45 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "IBM WebSphere Application Server Liberty vulnerabilities", https://junglewise.ai/threats/technologies/websphere-application-server-liberty, 13 November 2026.