CVE-2026-93895
9.1CriticalPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-284
Impact
Unauthenticated remote attackers can bypass access controls on configured gRPC service methods to access unauthorized endpoints or data. They only need network access to the exposed gRPC interface.
Root cause
Improper access control enforcement fails to restrict unauthorized calls to gRPC service methods.
Affected systems
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade to a fixed version beyond 26.0.0.10 once released by IBM, or consult IBM advisory 7292228 for specific iFixes; if you cannot patch immediately, restrict network access to exposed gRPC ports at the firewall or load balancer.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.