IBM Releases Fixes for Four IBM WebSphere Liberty Security Bypass and DoS Vulnerabilities
Do Son 
TL;DR
IBM published two security bulletins addressing four security flaws in IBM WebSphere Liberty. Two critical vulnerabilities, CVE-2026-93895 and CVE-2026-93909, carry a CVSS base score of 9.1 and allow remote authentication or access control bypass. Administrators should apply the available interim fixes for APAR DT502929 and APAR DT502359 immediately.
- Product: IBM WebSphere Application Server - Liberty
- Vulnerabilities: 4 flaws (CVE-2026-93895, CVE-2026-93909, CVE-2026-95695, CVE-2026-95696)
- Highest severity: 9.1 (Critical · CVSSv3)
- Worst impact: WebSphere Application Server Liberty Improper Access Control
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-93895 | 9.1 | CWE-284 | Not exploited |
| CVE-2026-93909 | 9.1 | CWE-384 | Not exploited |
| CVE-2026-95695 | 7.4 | CWE-863 | Not exploited |
| CVE-2026-95696 | 6.5 | CWE-400 | Not exploited |
Why These IBM WebSphere Liberty Vulnerabilities Matter
Enterprise organizations rely on IBM WebSphere Application Server Liberty to run cloud-native Java applications and microservices. Consequently, flaws in its authentication and remote procedure call modules expose internal services to unauthorized access. Furthermore, attackers can exploit both critical bugs over the network without user interaction or prior credentials. Currently, neither IBM nor the MITRE CVE database has confirmed public proof-of-concept code or active exploitation in the wild.
How the Attacks Work
gRPC Access Control Bypass and Denial of Service
The first IBM security bulletin for gRPC vulnerabilities details three flaws that occur when the grpc-1.0 feature is active. According to the advisory, CVE-2026-93895 (CVSS 9.1, CWE-284) means that “WebSphere Application Server Liberty could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.” Additionally, CVE-2026-95695 (CVSS 7.4, CWE-863) allows remote attackers to bypass security restrictions through incorrect authorization. Meanwhile, CVE-2026-95696 (CVSS 6.5, CWE-400) triggers an uncaught exception that causes uncontrolled resource consumption and a denial of service.
SAML Web Authentication Bypass
A separate IBM security advisory for CVE-2026-93909 highlights a critical session fixation flaw (CVSS 9.1, CWE-384). Specifically, this IBM WebSphere Liberty issue affects servers running the samlWeb-2.0 feature. As a result, a remote attacker can exploit improper session handling to bypass SAML authentication.
Affected Products and Versions
Based on vendor disclosures and published CVE records, the affected software versions depend on active server features:
- CVE-2026-93895, CVE-2026-95695, and CVE-2026-95696: IBM WebSphere Application Server Liberty versions 20.0.0.12 through 26.0.0.10 with
grpc-1.0enabled. - CVE-2026-93909: IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 with
samlWeb-2.0enabled.
Patch and Mitigation Steps
In both notices, “IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack.” Administrators using the grpc-1.0 feature on versions 20.0.0.12 through 26.0.0.10 must apply the interim fix for APAR DT502929. Similarly, teams running samlWeb-2.0 on versions 17.0.0.3 through 26.0.0.10 should install the interim fix for APAR DT502359. Alternatively, organizations can upgrade to IBM WebSphere Liberty Fix Pack 26.0.0.11 or later, targeted for fourth-quarter 2026 availability.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
