CVE-2026-105442
7.5HighPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-502
Impact
Remote, unauthenticated attackers can crash the messaging service and cause a denial of service. They only need network access to the exposed messaging endpoint.
Root cause
Insecure deserialization of untrusted input within the WebSphere messaging service crashes the application.
Affected systems
IBM WebSphere Application Server 8.5, 9.0, and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Check the vendor advisory at https://www.ibm.com/support/pages/node/7292221 for interim fixes and target remediation versions; restrict network access to the messaging service ports in firewalls if patching cannot happen immediately.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.