CVE-2026-93895— IBM WebSphere Application Server Liberty Improper Access Control
Quick assessment
Affected
IBM WebSphere Application Server - Liberty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IBM WebSphere Application Server - Liberty 20.0.0.12 至 26.0.0.10 版本可能存在一个安全漏洞，允许未经身份验证的远程攻击者绕过对 gRPC 服务方法配置的访问控制。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| IBM | WebSphere Application Server - Liberty | 20.0.0.12≤ 26.0.0.10 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93895
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IBM WebSphere Application Server Liberty Improper Access Control
Source: CVE Program / CVE List V5
Vulnerability Description
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | WebSphere Application Server - Liberty | 20.0.0.12 ~ 26.0.0.10 |
cpe:2.3:a:ibm:websphere_application_server_liberty:20.0.0.12:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-93895
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93895
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-93895 (1)
Same Patch Batch · IBM · 2026-10-13 · 18 CVEs total
| CVE-2026-53709 | 9.8 CRITICAL | MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example ena |
| CVE-2026-93909 | 9.1 CRITICAL | IBM WebSphere Application Server Liberty is affected by an authentication bypass |
| CVE-2026-101294 | 8.7 HIGH | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by |
| CVE-2026-93905 | 8.2 HIGH | IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted dat |
| CVE-2026-105443 | 8.2 HIGH | IBM WebSphere Application Server Liberty is affected by an improper access control |
| CVE-2026-93907 | 8.1 HIGH | IBM WebSphere Application Server is affected by a bypass authentication vulnerability |
| CVE-2026-95680 | 8.0 HIGH | IBM WebSphere Application Server is affected by an authorization bypass |
| CVE-2026-103499 | 7.5 HIGH | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by |
| CVE-2026-105442 | 7.5 HIGH | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by |
| CVE-2026-95695 | 7.4 HIGH | IBM WebSphere Application Server Liberty Incorrect Authorization |
| CVE-2026-14909 | 6.5 MEDIUM | IBM WebSphere Application Server Liberty Information Disclosure |
| CVE-2026-77816 | 6.5 MEDIUM | IBM WebSphere Application Server Liberty Improper Certificate Validation |
| CVE-2026-95696 | 6.5 MEDIUM | IBM WebSphere Application Server Liberty Denial of Service |
| CVE-2026-79715 | 5.5 MEDIUM | IBM WebSphere Application Server Liberty Path Traversal |
| CVE-2026-11713 | 5.4 MEDIUM | IBM WebSphere Application Server Liberty Incorrect Authorization |
| CVE-2026-53711 | 5.1 MEDIUM | MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI |
| CVE-2026-14532 | 4.3 MEDIUM | IBM WebSphere Application Server Liberty Integer Overflow |
IV. Related Vulnerabilities
Same product: WebSphere Application Server - Liberty
-
CVE-2026-93905
IBM WebSphere Application Server Liberty is affected by a de -
CVE-2026-93909
IBM WebSphere Application Server Liberty is affected by an a -
CVE-2026-95695
IBM WebSphere Application Server Liberty Incorrect Authoriza -
CVE-2026-95696
IBM WebSphere Application Server Liberty Denial of Service -
CVE-2026-101294
IBM WebSphere Application Server and WebSphere Application S
Same vendor: IBM
-
CVE-2026-93905
IBM WebSphere Application Server Liberty is affected by a de -
CVE-2026-93909
IBM WebSphere Application Server Liberty is affected by an a -
CVE-2026-95695
IBM WebSphere Application Server Liberty Incorrect Authoriza -
CVE-2026-95696
IBM WebSphere Application Server Liberty Denial of Service -
CVE-2026-101294
IBM WebSphere Application Server and WebSphere Application S
Same weakness: CWE-284
-
CVE-2026-61610
Lychee: unauthenticated photo starring reveals existence of -
CVE-2026-9703
Viewer role can create, modify and delete Loki alerting rule -
CVE-2026-103988
FileRise renameFolder omits destination-parent authorization -
CVE-2026-55387
InvoiceShelf bulk deletion lacks company scoping -
CVE-2026-55384
InvoiceShelf trusts client-supplied document totals
V. Comments for CVE-2026-93895
No comments yet