CVE-2026-93905
8.2HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-502
Impact
Unauthenticated remote attackers can corrupt the persisted status of batch job instances over the network. They need network access to the Liberty application server endpoints handling batch jobs.
Root cause
Untrusted deserialization (CWE-502) allows attackers to tamper with batch job state data.
Affected systems
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Fix & remediation
Upgrade to a fixed Liberty release beyond 26.0.0.10 or apply the vendor interim fix from IBM advisory 7292232. If patching immediately is not possible, restrict network access to batch management endpoints.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.