Description
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
Published: 2026-10-13
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Remote Access
Action: Patch Immediately
AI Analysis

Impact

IBM WebSphere Application Server Liberty versions 20.0.0.12 through 26.0.0.10 contain an improper access control flaw allowing an unauthenticated remote attacker to bypass security checks on gRPC service methods. This vulnerability is a direct result of CWE-284 and can enable an attacker to execute or invoke privileged operations on the server without proper authentication, effectively granting unauthorized remote control of the application.

Affected Systems

The affected product is IBM WebSphere Application Server Liberty, specifically the 20.0.0.12 to 26.0.0.10 releases when the grpc-1.0 feature is enabled. Only installations that have turned on this gRPC feature are susceptible.

Risk and Exploitability

The CVSS v3.1 base score is 9.1, indicating critical severity. The EPSS score is below 1 %, meaning exploitation probability is currently very low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw is exploitable remotely by an unauthenticated user who can send crafted gRPC requests to the vulnerable methods and bypass all configured access controls.

Generated by OpenCVE AI on October 16, 2026 at 04:21 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR DT502929. To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to  How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 .  For IBM WebSphere Application Server Liberty 20.0.0.12 - 26.0.0.10 using the grpc-1.0 feature:  · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves DT502929 https://www.ibm.com/support/pages/node/7277460 --OR-- · Apply Liberty Fix Pack 26.0.0.11 or later (targeted availability 4Q2026).  Additional interim fixes may be available and linked off the interim fix download page.

OpenCVE Recommended Actions

  • Apply the IBM WebSphere Application Server Liberty interim fix DT502929 after upgrading to the required minimal fix pack levels as specified by IBM.
  • Upgrade to Liberty Fix Pack 26.0.0.11 or a later version when it becomes available.
  • If the interim or newer fix cannot be applied immediately, disable the grpc-1.0 feature to eliminate the vulnerability until a patch is applied.

Generated by OpenCVE AI on October 16, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Ibm websphere Application Server
CPEs cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:*
Vendors & Products Ibm websphere Application Server

Sat, 17 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
Title IBM WebSphere Application Server Liberty Improper Access Control
First Time appeared Ibm
Ibm websphere Application Server Liberty
Weaknesses CWE-284
CPEs cpe:2.3:a:ibm:websphere_application_server_liberty:20.0.0.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.10:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm websphere Application Server Liberty
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Ibm Websphere Application Server Websphere Application Server Liberty
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-17T00:49:16.812Z

Reserved: 2026-09-18T20:30:18.225Z

Link: CVE-2026-93895

cve-icon Vulnrichment

Updated: 2026-10-17T00:49:13.215Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T21:19:57.743

Modified: 2026-10-22T18:55:12.890

Link: CVE-2026-93895

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T16:15:14Z

Weaknesses