CVE-2026-103499
HighCVSS 7.5Summary
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
Risk Assessment
The vulnerability may lead to resource exhaustion on the server, resulting in application unavailability and potential service disruptions.
Recommendation
It is recommended to apply relevant patches from IBM and monitor server resource usage for anomalies.
Other vulnerabilities in IBM WebSphere Application Server
See all- CVE-2026-105442High
IBM WebSphere Application Server 8.5, 9.0 and Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
- CVE-2026-101294High
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification.
- CVE-2026-95680High
IBM WebSphere Application Server 8.5 and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
- CVE-2026-93907High
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
- CVE-2017-1382High
IBM WebSphere Application Server versions 7.0, 8.0, 8.5, and 9.0 may create files with default permissions instead of customized ones when custom startup scripts are used. A local attacker could exploit this to gain access to files with an unknown impact.
- CVE-2017-1194High
IBM WebSphere Application Server versions 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a trusted user.
- CVE-2017-1151High
IBM WebSphere Application Server versions 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) could allow a user to gain elevated privileges on the system.
- CVE-2016-8919High
IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources.
- CVE-2016-5983High
IBM WebSphere Application Server (WAS) versions 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object.
- CVE-2016-5986High
IBM WebSphere Application Server (WAS) versions 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, 8.5.x before 8.5.5.11, 9.0.x before 9.0.0.2, and Liberty before 16.0.0.3 mishandles responses, allowing remote attackers to obtain sensitive information via unspecified vectors.
Original NVD description (English source)
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS