Description
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability.
Published: 2026-09-18
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass
Action: Immediate Patch
AI Analysis

Impact

IBM WebSphere Application Server 8.5, 9.0, and WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to a virtual host bypass flaw. Based on the description, it is inferred that the improper access control (CWE‑284) allows an attacker to manipulate the virtual host configuration and gain unauthorized access to application resources. This could enable the attacker to read, modify, or execute services exposed through the server, compromising the confidentiality and integrity of protected data.

Affected Systems

IBM WebSphere Application Server (traditional) versions 8.5.0 through 8.5.5.30 and 9.0.0 through 9.0.5.28, and IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 are affected. The flaw resides in the virtual host configuration component of these products.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity, and the EPSS score of < 1 % suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers would likely exploit the flaw remotely by sending crafted HTTP requests that manipulate the virtual host configuration, requiring only network access to the WebSphere Application Server. No special privileges are required, making the vulnerability potentially exploitable by any network attacker.

Generated by OpenCVE AI on October 23, 2026 at 07:13 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by applying the fix pack(s) listed below. For IBM WebSphere Application Server traditional: For V9.0.0.0 through 9.0.5.28: · Apply Fix Pack 9.0.5.29 https://www.ibm.com/support/pages/node/7285876 (availability September 2026) or later fix pack.  For V8.5.0.0 through 8.5.5.30: · Apply Fix Pack 8.5.5.31 https://www.ibm.com/support/pages/node/7285869 (availability September 2026) or later fix pack.  For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.8: · Apply Liberty Fix Pack 26.0.0.9 https://www.ibm.com/support/pages/node/7285875 (availability September 2026) or later fix pack.

OpenCVE Recommended Actions

  • Download and install the appropriate IBM fix pack: for traditional WebSphere Application Server, apply Fix Pack 9.0.5.29 or later (for 9.x) or Fix Pack 8.5.5.31 or later (for 8.x); for Liberty, apply Liberty Fix Pack 26.0.0.9 or later.
  • Restart the WebSphere Application Server after applying the patch to ensure changes take effect.
  • Review the virtual host configuration to confirm that only authorized hosts and paths are enabled, and remove or restrict any unused virtual hosts to reduce exposure.

Generated by OpenCVE AI on October 23, 2026 at 07:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server 8.5 and 9.0 are affected by a virtual host bypass vulnerability. IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability.
Title IBM WebSphere Application Server IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access Control
First Time appeared Ibm websphere Application Server Liberty
CPEs cpe:2.3:a:ibm:websphere_application_server_liberty:17.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.8:*:*:*:*:*:*:*
Vendors & Products Ibm websphere Application Server Liberty
References

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability. IBM WebSphere Application Server 8.5 and 9.0 are affected by a virtual host bypass vulnerability.
Title Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced. IBM WebSphere Application Server
First Time appeared Ibm websphere Application Server
CPEs cpe:2.3:a:ibm:cics_tx_advanced:10.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cics_tx_advanced:10.1:*:*:*:*:*:*:*		 cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*
Vendors & Products Ibm websphere Application Server
References

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability.
Title Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.
First Time appeared Ibm
Ibm cics Tx Advanced
Weaknesses CWE-284
CPEs cpe:2.3:a:ibm:cics_tx_advanced:10.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cics_tx_advanced:10.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm cics Tx Advanced
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Ibm Cics Tx Advanced Websphere Application Server Websphere Application Server Liberty
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-22T18:53:28.715Z

Reserved: 2026-06-08T03:27:16.708Z

Link: CVE-2026-11549

cve-icon Vulnrichment

Updated: 2026-09-18T19:45:34.492Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-18T20:17:00.923

Modified: 2026-10-22T19:17:49.217

Link: CVE-2026-11549

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T07:15:17Z

Weaknesses