CVE-2026-95695
7.4HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-863
Impact
Remote attackers can bypass security restrictions and access protected resources without valid credentials. They only need network access to the exposed WebSphere Liberty application.
Root cause
An incorrect authorization flaw fails to properly enforce access controls on protected endpoints.
Affected systems
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade to WebSphere Liberty 26.0.0.11 or later, or apply the vendor interim fix cited in IBM advisory 7292228. If patching immediately is not possible, restrict network access to affected Liberty instances via firewall or reverse proxy.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.