CVE-2026-2482
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 are vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to execute unauthorized actions on behalf of a trusted user.
Risk Assessment
An attacker can exploit user trust to perform unwanted operations, such as configuration changes or data theft, without the victim's knowledge.
Recommendation
Apply security patches from IBM for WebSphere Application Server Liberty or implement CSRF protection mechanisms like synchronizer tokens.
Other vulnerabilities in IBM WebSphere Application Server Liberty
See all- CVE-2026-3621High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.4 is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.
- CVE-2026-14525Critical
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
- CVE-2026-10571Medium
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.
- CVE-2026-18499High
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.
- CVE-2026-14980High
IBM WebSphere Application Server Liberty is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.
- CVE-2026-11897High
IBM WebSphere Application Server Liberty is vulnerable to a denial of service (DoS) attack via a specially crafted request that causes excessive memory consumption.
- CVE-2026-15280High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 ND Collective Controller is vulnerable to a path-segment injection vulnerability in the collective routing mechanism.
- CVE-2026-15057High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.
- CVE-2026-14976High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
- CVE-2026-16192High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.
Original NVD description (English source)
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS