IBM WebSphere DoS Vulnerability CVE-2026-103499 Advisory and Fix

Vulnerability Overview IBM WebSphere Application Server and WebSphere Application Server Liberty contain a denial-of-service vulnerability (CVE-2026-103499). This vulnerability allows a remote unauthenticated attacker to cause a service interruption through uncontrolled resource consumption. Affected Scope Affected Products: - WebSphere Application Server - Liberty 17.0.0.3 - 26.0.0.10 - WebSphere Application Server 8.5 - WebSphere Application Server 9.0 Operating Systems: - AIX, IBM i, Linux, Windows, z/OS, Mac OS Remediation IBM strongly recommends applying the currently available interim fix or a fix pack that includes the fix as soon as possible to address this vulnerability. The specific remediation steps are as follows: For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.10 Using the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 features: - Upgrade to the required interim fix level, then apply the interim fix that resolves DT502944. - Alternatively, apply Fix Pack 26.0.0.11 or a later version (Target Availability: 4Q2026). For IBM WebSphere Application Server (Traditional) V9.0.0.0 to 9.0.5.29: - Upgrade to the required interim fix level, then apply the interim fix that resolves DT502943. - Alternatively, apply Fix Pack 9.0.5.30 or a later version (Target Availability: 4Q2026). V8.5.0.0 to 8.5.5.31: - Upgrade to the required interim fix level, then apply the interim fix that resolves DT502943. - Alternatively, apply Fix Pack 8.5.5.32 or a later version (Target Availability: 4Q2026). Additional Information Reference Links: - Complete CVSS v3 Guide - On-line Calculator v3 - How to determine if Liberty is using a specific feature Related Resources: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Publication Date: October 13, 2026 Document ID: 7292214 Modification Date: October 13, 2026 Initial Publication Date: October 13, 2026 Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry standard designed to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is" and makes no express or implied warranties. Customers are responsible for assessing the impact of the vulnerability on their environment. IBM periodically updates product component records and may identify packages not previously identified. IBM does not guarantee that referenced products have been in use since the CVE date, nor does it guarantee that IBM was aware of the vulnerability at the time of the vulnerability disclosure. --- Note: POC code or exploit code is not included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere DoS Vulnerability CVE-2026-103499 Advisory and Fix

More from this source