Threat level Severe
Contact
Critical 9.1
CVE-2026-95695

IBM Websphere Application Server — security bypass.

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.

WeaknessCWE-863: Incorrect authorization
Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploit chance, 30 days
0.3%
Higher than 25% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

IBM WebSphere Application Server – Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.

What to do

  1. 01Check whether you run IBM Websphere Application Server, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCVE-2026-1146259.9Arista VeloCloud OrchestratorCVE-2026-1114979.8Google Brotli
Vendor
IBM47 CVEs in 30 days
All IBM CVEs

Other CVEs in IBM Websphere Application Server

2 more CVEs

All IBM Websphere Application Server CVEs
9.1IBM Websphere Application Server — improper access control.EPSS 0.4%9.1IBM Websphere Application Server — authentication bypass.EPSS 0.3%