CVE-2026-78636 PUBLISHED

IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

Assigner: ibm
Reserved: 24.08.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	WebSphere Application Server - Liberty
Versions	affected from 17.0.0.3 to 26.0.0.10 (incl.)

Solutions

IBM strongly recommends addressing the vulnerabilities now by applying the fix pack(s) listed below.

For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.10: · Apply Liberty Fix Pack 26.0.0.11 https://www.ibm.com/support/pages/node/7294658 (availability November 2026) or later fix pack.

References

https://www.ibm.com/support/pages/node/7295268

Problem Types

CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') CWE