CVE-2026-78636
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
IBM WebSphere Application Server Liberty is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.
Risk Assessment
Information disclosure can provide an attacker with data useful for further attacks. The confidentiality of the application environment is at risk.
Recommendation
Update IBM WebSphere Application Server Liberty to a patched version. Restrict access to the JMX REST connector to trusted networks.
Other vulnerabilities in IBM WebSphere Application Server Liberty
See all- CVE-2026-93909Critical
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
- CVE-2026-93895Critical
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
- CVE-2026-14525Critical
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
- CVE-2026-11547Medium
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 has a server-side request forgery vulnerability in the Admin Center deploy validation endpoint.
- CVE-2026-10844Medium
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks.
- CVE-2026-108284Medium
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.
- CVE-2026-103320Medium
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.
- CVE-2026-95696Medium
IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception. An attacker could exploit this to make the service unavailable.
- CVE-2026-95695High
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
- CVE-2026-93905High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances. The vulnerability can be exploited without authentication, increasing the risk.
Original NVD description (English source)
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS