# IBM WebSphere Application Server vulnerabilities Source: https://junglewise.ai/threats/technologies/websphere-application-server Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/websphere-application-server.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 67 vulnerabilities in IBM WebSphere Application Server: 0 in the last 7 days and 30 in the last 90 days, 10 of them critical and 1 exploited in the wild. The most recent, CVE-2026-105442, was published on 13 October 2026. 5 vulnerabilities in the last four weeks, down 75% on the four before (20). ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 30 - All time: 67 (10 critical, 1 exploited in the wild) ## About IBM WebSphere Application Server Java-based application server for deploying enterprise applications. ## Latest IBM WebSphere Application Server vulnerabilities - [CVE-2026-105442: IBM WebSphere Application Server insecure deserialization in messaging](https://junglewise.ai/threats/cve-2026-105442-ibm-websphere-application-server-8-5-and-9-0-and-ibm-websphere) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-101294: IBM WebSphere Application Server cryptographic signature verification bypass](https://junglewise.ai/threats/cve-2026-101294-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (high, CVSS 8.7, published 13 Oct 2026) - [CVE-2026-95680: IBM WebSphere Application Server authorization bypass in authentication](https://junglewise.ai/threats/cve-2026-95680-ibm-websphere-application-server-8-5-and-9-0-could-allow-an) (high, CVSS 8, published 13 Oct 2026) - [CVE-2026-93907: IBM WebSphere Application Server authentication bypass in CSIv2](https://junglewise.ai/threats/cve-2026-93907-ibm-websphere-application-server-8-5-and-9-0-could-allow-a-remote) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-103499: IBM WebSphere Application Server denial of service via resource consumption](https://junglewise.ai/threats/cve-2026-103499-ibm-websphere-application-server-liberty-17-0-0-3-through-26-0-0) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-11722: IBM WebSphere Application Server HTTP request smuggling](https://junglewise.ai/threats/cve-2026-11722-ibm-websphere-application-server-and-websphere-application-server) (medium, CVSS 4.8, published 18 Sep 2026) - [CVE-2026-11711: IBM WebSphere Application Server deserialization vulnerability in Name Service](https://junglewise.ai/threats/cve-2026-11711-ibm-websphere-application-server-9-0-and-8-5-is-affected-by-a) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-11710: IBM WebSphere Application Server HTTP request smuggling](https://junglewise.ai/threats/cve-2026-11710-ibm-websphere-application-server-8-5-is-affected-by-an-http) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-11549: IBM WebSphere Application Server virtual host bypass](https://junglewise.ai/threats/cve-2026-11549-ibm-websphere-application-server-and-websphere-application-server) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-11548: IBM WebSphere Application Server HTTP request smuggling](https://junglewise.ai/threats/cve-2026-11548-ibm-websphere-application-server-and-websphere-application-server) (medium, CVSS 4.8, published 18 Sep 2026) - [CVE-2026-11540: IBM WebSphere Application Server information disclosure in FileTransfer servlet](https://junglewise.ai/threats/cve-2026-11540-ibm-websphere-application-server-9-0-and-8-5-could-allow-a-remote) (medium, CVSS 5.3, published 18 Sep 2026) - [CVE-2026-11539: IBM WebSphere Application Server authentication bypass in SOAP/JMX connector](https://junglewise.ai/threats/cve-2026-11539-ibm-websphere-application-server-9-0-and-8-5-is-affected-by-an) (medium, CVSS 5.3, published 18 Sep 2026) - [CVE-2026-11537: IBM WebSphere Application Server information disclosure via FileTransfer servlet](https://junglewise.ai/threats/cve-2026-11537-ibm-websphere-application-server-9-0-and-8-5-could-allow-a-remote) (medium, CVSS 4.3, published 18 Sep 2026) - [CVE-2026-10841: IBM WebSphere Application Server HTTP request smuggling](https://junglewise.ai/threats/cve-2026-10841-ibm-websphere-application-server-http-request-smuggling) (medium, CVSS 4.2, published 18 Sep 2026) - [CVE-2026-16435: IBM WebSphere Application Server authentication bypass in XD/Intelligent-Management](https://junglewise.ai/threats/cve-2026-16435-ibm-websphere-application-server-authentication-bypass-in-xd) (medium, CVSS 5.9, published 14 Sep 2026) - [CVE-2026-16190: IBM WebSphere Application Server authorization bypass](https://junglewise.ai/threats/cve-2026-16190-ibm-websphere-application-server-authorization-bypass) (low, CVSS 3.1, published 14 Sep 2026) - [CVE-2026-16189: IBM WebSphere Application Server log injection](https://junglewise.ai/threats/cve-2026-16189-ibm-websphere-application-server-log-injection) (medium, CVSS 4.8, published 14 Sep 2026) - [CVE-2026-16188: IBM WebSphere Application Server log injection vulnerability](https://junglewise.ai/threats/cve-2026-16188-ibm-websphere-application-server-log-injection-vulnerability) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2026-16187: IBM WebSphere Application Server authentication bypass in admin console](https://junglewise.ai/threats/cve-2026-16187-ibm-websphere-application-server-authentication-bypass-in-admin) (medium, CVSS 6.5, published 14 Sep 2026) - [CVE-2026-16186: IBM WebSphere Application Server reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-16186-ibm-websphere-application-server-reflected-cross-site-scripting) (medium, CVSS 5.4, published 14 Sep 2026) - [CVE-2026-16185: IBM WebSphere Application Server authentication bypass in admin console servlet](https://junglewise.ai/threats/cve-2026-16185-ibm-websphere-application-server-authentication-bypass-in-admin) (medium, CVSS 6.4, published 14 Sep 2026) - [CVE-2026-15887: IBM WebSphere Application Server blind server-side request forgery in SOAP](https://junglewise.ai/threats/cve-2026-15887-ibm-websphere-application-server-blind-server-side-request) (medium, CVSS 5.4, published 14 Sep 2026) - [CVE-2026-15634: IBM WebSphere Application Server HTTP request smuggling via transfer-encoding header](https://junglewise.ai/threats/cve-2026-15634-ibm-websphere-application-server-http-request-smuggling-via) (medium, CVSS 6.5, published 14 Sep 2026) - [CVE-2026-15412: IBM WebSphere Application Server open redirect phishing attack](https://junglewise.ai/threats/cve-2026-15412-ibm-websphere-application-server-open-redirect-phishing-attack) (medium, CVSS 6.5, published 14 Sep 2026) - [CVE-2026-15396: IBM WebSphere Application Server HTTP request smuggling via transfer-encoding](https://junglewise.ai/threats/cve-2026-15396-ibm-websphere-application-server-http-request-smuggling-via) (medium, CVSS 6.5, published 14 Sep 2026) ## Most severe IBM WebSphere Application Server vulnerabilities - [CVE-2015-7450: IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.](https://junglewise.ai/threats/cve-2015-7450-ibm-websphere-application-server-and-server-hypervisor-edition) (critical, exploited in the wild, CVSS 9.8, published 10 Jan 2022) - [CVE-2026-14512: IBM WebSphere Application Server unsafe deserialization](https://junglewise.ai/threats/cve-2026-14512-ibm-websphere-application-server-unsafe-deserialization) (critical, CVSS 9.8, published 28 Jul 2026) - [CVE-2026-14446: IBM WebSphere Application Server privilege escalation in administrative console](https://junglewise.ai/threats/cve-2026-14446-ibm-websphere-application-server-privilege-escalation-in) (critical, CVSS 9.8, published 28 Jul 2026) - [CVE-2026-14529: IBM WebSphere Application Server SSRF in SIP container](https://junglewise.ai/threats/cve-2026-14529-ibm-websphere-application-server-ssrf-in-sip-container) (critical, CVSS 9.4, published 29 Jul 2026) - [CVE-2026-11707: IBM WebSphere Application Server XSS in administrative console login page](https://junglewise.ai/threats/cve-2026-11707-ibm-websphere-application-server-xss-in-administrative-console) (critical, CVSS 9.3, published 30 Jul 2026) - [CVE-2026-11712: IBM WebSphere Application Server XSS in administrative console help system](https://junglewise.ai/threats/cve-2026-11712-ibm-websphere-application-server-xss-in-administrative-console) (critical, CVSS 9.3, published 30 Jun 2026) - [CVE-2026-11708: IBM WebSphere Application Server XSS in administrative console help system](https://junglewise.ai/threats/cve-2026-11708-ibm-websphere-application-server-xss-in-administrative-console) (critical, CVSS 9.3, published 30 Jun 2026) - [CVE-2026-8644: IBM WebSphere Application Server identity spoofing authentication bypass](https://junglewise.ai/threats/cve-2026-8644-ibm-websphere-application-server-identity-spoofing-authentication) (critical, CVSS 9.1, published 1 Jun 2026) - [CVE-2026-9319: IBM WebSphere Application Server remote code execution in JAX-WS](https://junglewise.ai/threats/cve-2026-9319-ibm-websphere-application-server-remote-code-execution-in-jax-ws) (critical, CVSS 9, published 1 Jun 2026) - [CVE-2026-9311: IBM WebSphere Application Server remote code execution via security bypass](https://junglewise.ai/threats/cve-2026-9311-ibm-websphere-application-server-remote-code-execution-via) (critical, CVSS 9, published 1 Jun 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, down 75% on the four before (20). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 5 | 0 | 0 | | 14 Sep 2026 | 20 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 5 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other IBM technologies - [IBM API Connect](https://junglewise.ai/threats/technologies/api-connect): 207 vulnerabilities - [IBM AIX](https://junglewise.ai/threats/technologies/aix): 181 vulnerabilities - [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss): 154 vulnerabilities - [IBM i](https://junglewise.ai/threats/technologies/i): 120 vulnerabilities - [IBM Guardium Data Protection](https://junglewise.ai/threats/technologies/guardium-data-protection): 93 vulnerabilities - [IBM PowerVM VIOS](https://junglewise.ai/threats/technologies/powervm-vios): 73 vulnerabilities - [IBM Vios](https://junglewise.ai/threats/technologies/vios): 72 vulnerabilities - [IBM WebSphere Application Server Liberty](https://junglewise.ai/threats/technologies/websphere-application-server-liberty): 56 vulnerabilities - [IBM Verify Identity Access](https://junglewise.ai/threats/technologies/verify-identity-access): 50 vulnerabilities - [IBM Datastage On Cloud Pak For Data](https://junglewise.ai/threats/technologies/datastage-on-cloud-pak-for-data): 48 vulnerabilities - [IBM Mq](https://junglewise.ai/threats/technologies/mq): 46 vulnerabilities - [IBM Financial Transaction Manager](https://junglewise.ai/threats/technologies/financial-transaction-manager): 45 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "IBM WebSphere Application Server vulnerabilities", https://junglewise.ai/threats/technologies/websphere-application-server, 13 November 2026.