CVE-2026-101294
8.7HighPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-325
Impact
Remote unauthenticated attackers can bypass cryptographic signature verification, potentially allowing unauthorized data tampering or unauthorized access across trust boundaries. The attacker only needs network access to the target service.
Root cause
Improper cryptographic signature verification allows forged or invalid signatures to be accepted as valid.
Affected systems
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10, and IBM WebSphere Application Server 8.5 and 9.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Fix & remediation
Upgrade to the vendor-provided patch or fixed release detailed in IBM advisory node 7292235. No interim workarounds are documented, so restrict network access to affected WebSphere endpoints if patching must wait.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.