WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-7450 In wildKEV | 9.8 | Jan 2 | IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. Affected: 7.0.0.0; 8.0.0.0; 8.5; 8.5.0.0; 8.5.5.5 |
| CVE-2026-8400 | 9.8 | Aug 5 | Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU Affected: 8.5; 9.0 |
| CVE-2026-14529 | 9.8 | Jul 29 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery Affected: 9.0; 8.5 |
| CVE-2026-14446 | 9.8 | Jul 28 | IBM WebSphere Application Server is affected by a privilege escalation Affected: 9.0; 8.5 |
| CVE-2026-14512 | 9.8 | Jul 28 | IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information Affected: 9.0; 8.5 |
| CVE-2026-14974 | 9.8 | Jul 28 | IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities Affected: 8.5; 9.0 |
| CVE-2026-14976 | 9.8 | Jul 28 | IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2026-16184 | 9.8 | Jul 28 | IBM WebSphere Application Server is affected by an authentication bypass Affected: 9.0; 8.5 |
| CVE-2026-11541 | 9.8 | Jun 30 | Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms. Affected: 8.5.0.0 before 8.5.5.31; 9.0.0.0 before 9.0.5.29; 17.0.0.3 through 26.0.0.6 |
| CVE-2026-11546 | 9.8 | Jun 30 | IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability Affected: 17.0.0.3 before 26.0.0.8 |
| CVE-2026-11714 | 9.8 | Jun 30 | IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability Affected: 17.0.0.3 before 26.0.0.8 |
| CVE-2026-9072 | 9.8 | Jun 22 | WebSphere Application Server Remote Code Execution Affected: 8.5; 9.0 |
| CVE-2026-8633 | 9.8 | May 26 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins Affected: 8.5.0.0 through 8.5.5.29; 8.5.0.0 through 8.5.5.29; 9.0.0.0 through 9.0.5.27; 9.0.0.0 through 9.0.5.27 |
| CVE-2025-14917 | 9.8 | Mar 25 | IBM WebSphere Application Server Liberty could provide weaker than expected security Affected: 17.0.0.3 before 26.0.0.4 |
| CVE-2025-14923 | 9.8 | Mar 3 | IBM WebSphere Application Server Liberty could provide weaker than expected security Affected: 17.0.0.3 before 26.0.0.3 |
| CVE-2025-36038 | 9.8 | Jun 25 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects Affected: 8.5 before 8.5.5.28; 9.0 before 9.0.5.25 |
| CVE-2023-23477 | 9.8 | Feb 3 | IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized… Affected: 8.5; 9.0 |
| CVE-2020-4589 | 9.8 | Aug 13 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.4 |
| CVE-2020-4450 | 9.8 | Jun 5 | IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized… Affected: 8.5.0.0 before 8.5.5.18; 9.0.0.0 before 9.0.5.5 |
| CVE-2020-4448 | 9.8 | Jun 5 | IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence… Affected: 8.5.0.0 before 8.5.5.18; 9.0.0.0 before 9.0.5.4 |
| CVE-2019-4279 | 9.8 | May 17 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from… Affected: 8.5.0.0 through 8.5.5.15; 9.0.0.0 through 9.0.0.11; 7.0.0.0 |
| CVE-2018-1904 | 9.8 | Dec 11 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2018-1851 | 9.8 | Oct 31 | IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization Affected: before 18.0.0.3 |
| CVE-2018-1567 | 9.8 | Sep 7 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through the SOAP connector with a serialized object from… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2011-4889 | 9.8 | Feb 8 | The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0… Affected: 6.1 before 6.1.0.43; 7.0 before 7.0.0.21; 8.0 before 8.0.0.2 |
| CVE-2026-14525 | 9.4 | Aug 13 | IBM WebSphere Application Server Liberty is affected by an authenication bypass Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2026-11707 | 9.3 | Jul 30 | Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager Affected: 8.5 before 8.5.5.30; 9.0 before 9.0.5.29 |
| CVE-2026-11708 | 9.3 | Jun 30 | IBM WebSphere Application Server is affected by a cross-site scripting vulnerability Affected: 9.0; 8.5 |
| CVE-2026-11712 | 9.3 | Jun 30 | IBM WebSphere Application Server is affected by a cross-site scripting vulnerability Affected: 9.0; 8.5 |
| CVE-2026-93909 | 9.1 | Oct 13 | IBM WebSphere Application Server Liberty is affected by an authentication bypass Affected: 17.0.0.3 before 26.0.0.11 |
| CVE-2026-93895 | 9.1 | Oct 13 | IBM WebSphere Application Server Liberty Improper Access Control Affected: 20.0.0.12 before 26.0.0.11 |
| CVE-2026-95695 | 9.1 | Oct 13 | IBM WebSphere Application Server Liberty Incorrect Authorization Affected: 20.0.0.12 before 26.0.0.11 |
| CVE-2026-9006 | 9.1 | Jun 22 | IBM WebSphere Application Server is affected by server-side request forgery Affected: 9.0 through 7.0.2 Interim Fix 035; 8.5.0 through 7.0.3 Interim Fix 017 |
| CVE-2026-8646 | 9.1 | Jun 22 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 9.0.0 through 7.0.2 Interim Fix 035; 8.5.0 through 7.0.3 Interim Fix 017 |
| CVE-2026-8644 | 9.1 | Jun 1 | IBM WebSphere Application Server is affected by an identity spoofing vulnerability Affected: 9.0 through 1.1.9.12; 8.5 |
| CVE-2015-5041 | 9.1 | Jun 6 | The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive… Affected: through 3.0.9.20 |
| CVE-2026-9319 | 9.0 | Jun 1 | IBM WebSphere Application Server is affected by a remote code execution vulnerability Affected: 9.0 through 1.1.9.12; 8.5 |
| CVE-2026-9311 | 9.0 | Jun 1 | IBM WebSphere Application Server is affected by remote code execution Affected: 9.0 through 1.1.9.12; 8.5 |
| CVE-2026-14980 | 8.8 | Jul 30 | IBM WebSphere Application Server Liberty is affected by a cross-site request forgery Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2026-2482 | 8.8 | Jul 29 | IBM WebSphere Application Server Liberty is affected by a cross-site request forgery Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2026-8858 | 8.8 | Jun 22 | WebSphere Application Server Remote Code Execution Affected: 8.5; 9.0 |
| CVE-2024-37532 | 8.8 | Jun 20 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation Affected: 8.5.0.0; 9.0.0.0 |
| CVE-2022-22476 | 8.8 | Jul 8 | IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request Affected: 17.0.0.3 before 22.0.0.8 |
| CVE-2021-39031 | 8.8 | Jan 25 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection Affected: 17.0.0.3 through 22.0.0.1 |
| CVE-2021-29736 | 8.8 | Jul 30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.20; 9.0.0.0 through 9.0.5.8 |
| CVE-2021-29754 | 8.8 | Jun 11 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when using the SAML Web Inbound Trust Association Interceptor (TAI) Affected: 7.0.0.0 before 7.0.0.45; 8.0.0.0 before 8.0.0.15; 8.5.0.0 before 8.5.5.20; 9.0.0.0 before 9.0.5.8 |
| CVE-2020-4534 | 8.8 | Aug 3 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2020-4464 | 8.8 | Jul 17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.4 |
| CVE-2020-4362 | 8.8 | Apr 10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.3 |
| CVE-2018-1926 | 8.8 | Dec 12 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
The 500 most important CVEs for this product (exploited first, then by severity)