CVE-2026-10844 PUBLISHED

IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

Assigner: ibm
Reserved: 04.06.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS Score: 4.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	WebSphere Application Server - Liberty
Versions	affected from 17.0.0.3 to 26.0.0.10 (incl.)

Solutions

IBM strongly recommends addressing the vulnerabilities now by applying the fix pack(s) listed below.

For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.10: · Apply Liberty Fix Pack 26.0.0.11 https://www.ibm.com/support/pages/node/7294658 (availability November 2026) or later fix pack.

References

https://www.ibm.com/support/pages/node/7295268

Problem Types

CWE-601 URL Redirection to Untrusted Site ('Open Redirect') CWE