WebSphere Application Server
IBM- Product type
- Other
- Catalog vulnerabilities
- 158
Severity across 100 analyzed records
en
Verify to analyze this security profile
As of 09/13/2026, within CyStack's analyzed data, WebSphere Application Server has 32 security vulnerabilities published in the last 90 days. Of these, 23 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of WebSphere Application Server and determine which vulnerabilities affect that version.
| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-9667IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | Exploitation statusNot confirmed | FixYes | Published09/10/2026 | SeverityMedium |
CVE-2026-9176IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | Exploitation statusNot known exploited | FixYes | Published09/10/2026 | SeverityMedium |
CVE-2026-9327IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | Exploitation statusNot known exploited | FixYes | Published09/10/2026 | SeverityMedium |
CVE-2026-9336IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | Exploitation statusNot confirmed | FixYes | Published09/10/2026 | SeverityMedium |
CVE-2026-9338IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | Exploitation statusNot known exploited | FixYes | Published09/10/2026 | SeverityMedium |
CVE-2026-8400Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU | Exploitation statusNot known exploited | FixYes | Published08/05/2026 | SeverityHigh |
CVE-2026-11536IBM WebSphere Application Server is affected by a remote code execution vulnerability | Exploitation statusNot known exploited | FixYes | Published07/30/2026 | SeverityHigh |
CVE-2026-9322IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | Exploitation statusNot known exploited | FixYes | Published07/30/2026 | SeverityHigh |
CVE-2026-10842IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability | Exploitation statusNot known exploited | FixYes | Published07/30/2026 | SeverityHigh |
CVE-2026-14529IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery | Exploitation statusNot known exploited | FixYes | Published07/29/2026 | SeverityCritical |
CVE-2026-14446IBM WebSphere Application Server is affected by a privilege escalation | Exploitation statusNot known exploited | FixYes | Published07/28/2026 | SeverityCritical |
CVE-2026-14515IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities | Exploitation statusNot known exploited | FixYes | Published07/28/2026 | SeverityMedium |
CVE-2026-14512IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information | Exploitation statusNot known exploited | FixYes | Published07/28/2026 | SeverityCritical |
CVE-2026-14528IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information | Exploitation statusNot known exploited | FixYes | Published07/28/2026 | SeverityHigh |
CVE-2026-14974IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities | Exploitation statusNot known exploited | FixYes | Published07/28/2026 | SeverityHigh |
CVE-2026-14981IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | Exploitation statusNot known exploited | FixYes | Published07/28/2026 | SeverityHigh |
CVE-2026-15064IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | Exploitation statusNot known exploited | FixYes | Published07/28/2026 | SeverityHigh |
CVE-2026-15325IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | Exploitation statusNot known exploited | FixYes | Published07/28/2026 | SeverityHigh |
CVE-2026-15328IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests | Exploitation statusNot known exploited | FixYes | Published07/28/2026 | SeverityHigh |
CVE-2026-16184IBM WebSphere Application Server is affected by an authentication bypass | Exploitation statusNot known exploited | FixYes | Published07/28/2026 | SeverityHigh |
CVE-2026-11541Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms. | Exploitation statusNot known exploited | FixYes | Published06/30/2026 | SeverityHigh |
CVE-2026-11594IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities | Exploitation statusNot known exploited | FixYes | Published06/30/2026 | SeverityHigh |
CVE-2026-11595IBM WebSphere Application Server is affected by a Path Traversal vulnerability | Exploitation statusNot known exploited | FixYes | Published06/30/2026 | SeverityMedium |
CVE-2026-11708IBM WebSphere Application Server is affected by a cross-site scripting vulnerability | Exploitation statusNot known exploited | FixYes | Published06/30/2026 | SeverityCritical |
CVE-2026-11712IBM WebSphere Application Server is affected by a cross-site scripting vulnerability | Exploitation statusNot known exploited | FixYes | Published06/30/2026 | SeverityCritical |
CVE-2026-10852Websphere Application Server is Affected By a Denial of Service | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityMedium |
CVE-2026-9320IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityMedium |
CVE-2026-9071IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityHigh |
CVE-2026-9006IBM WebSphere Application Server is affected by server-side request forgery | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityHigh |
CVE-2026-8646IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityHigh |
CVE-2026-10845IBM WebSphere Application Server is affected by an authentication bypass vulnerability | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityHigh |
CVE-2026-9072WebSphere Application Server Remote Code Execution | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityHigh |
CVE-2026-8858WebSphere Application Server Remote Code Execution | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityHigh |
CVE-2026-9330IBM WebSphere Application Server is affected by remote code execution | Exploitation statusNot known exploited | FixYes | Published06/01/2026 | SeverityHigh |
CVE-2026-9319IBM WebSphere Application Server is affected by a remote code execution vulnerability | Exploitation statusNot known exploited | FixYes | Published06/01/2026 | SeverityCritical |
CVE-2026-9311IBM WebSphere Application Server is affected by remote code execution | Exploitation statusNot known exploited | FixYes | Published06/01/2026 | SeverityCritical |
CVE-2026-8644IBM WebSphere Application Server is affected by an identity spoofing vulnerability | Exploitation statusNot known exploited | FixYes | Published06/01/2026 | SeverityCritical |
CVE-2026-4410IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service | Exploitation statusNot known exploited | FixYes | Published05/27/2026 | SeverityMedium |
CVE-2025-13333IBM WebSphere Application Server could provide weaker than expected security | Exploitation statusNot known exploited | FixYes | Published02/17/2026 | SeverityMedium |
CVE-2025-12635IBM WebSphere Application Server and WebSphere Application Server Liberty Cross-Site Scripting | Exploitation statusNot known exploited | FixYes | Published12/08/2025 | SeverityMedium |
CVE-2025-36099IBM WebSphere Application Server denial of service | Exploitation statusNot known exploited | FixYes | Published09/29/2025 | SeverityMedium |
CVE-2025-33142IBM WebSphere Application Server information disclosure | Exploitation statusNot known exploited | FixYes | Published08/14/2025 | SeverityMedium |
CVE-2024-56339IBM WebSphere Application Server information disclosure | Exploitation statusNot known exploited | FixYes | Published08/07/2025 | SeverityLow |
CVE-2025-36097IBM WebSphere Application Server denial of service | Exploitation statusNot known exploited | FixYes | Published07/16/2025 | SeverityHigh |
CVE-2025-36038IBM WebSphere Application Server code execution | Exploitation statusNot known exploited | FixYes | Published06/25/2025 | SeverityCritical |
CVE-2025-33104IBM WebSphere Application Server cross | Exploitation statusNot known exploited | FixYes | Published05/14/2025 | SeverityMedium |
CVE-2025-27907IBM WebSphere Application Server server-side request forgery | Exploitation statusNot known exploited | FixYes | Published04/22/2025 | SeverityMedium |
CVE-2024-45087IBM WebSphere Application Server cross-site scripting | Exploitation statusNot known exploited | FixNot confirmed | Published11/11/2024 | SeverityMedium |
CVE-2024-45086IBM WebSphere Application Server XML external entity injection | Exploitation statusNot known exploited | FixNot confirmed | Published11/04/2024 | SeverityMedium |
CVE-2024-45071IBM WebSphere Application Server cross-site scripting | Exploitation statusNot known exploited | FixNot confirmed | Published10/16/2024 | SeverityMedium |
CVE-2024-45072IBM WebSphere Application Server XML external entity injection | Exploitation statusNot known exploited | FixNot confirmed | Published10/16/2024 | SeverityMedium |
CVE-2024-45085IBM WebSphere Application Server denial of service | Exploitation statusNot known exploited | FixNot confirmed | Published10/15/2024 | SeverityMedium |
CVE-2024-45073IBM WebSphere Application Server cross-site scripting | Exploitation statusNot known exploited | FixNot confirmed | Published09/30/2024 | SeverityMedium |
CVE-2023-50315IBM WebSphere Application Server information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Published08/14/2024 | SeverityMedium |
CVE-2024-35154IBM WebSphere Application Server code execution | Exploitation statusNot known exploited | FixNot confirmed | Published07/09/2024 | SeverityHigh |
CVE-2024-35153IBM WebSphere Application Server cross-site scripting | Exploitation statusNot known exploited | FixNot confirmed | Published06/27/2024 | SeverityMedium |
CVE-2024-37532IBM WebSphere Application Server identity spoofing | Exploitation statusNot known exploited | FixNot confirmed | Published06/20/2024 | SeverityHigh |
CVE-2024-25026IBM WebSphere Application Server denial of service | Exploitation statusNot known exploited | FixYes | Published04/25/2024 | SeverityMedium |
CVE-2024-22329IBM WebSphere Application Server server-side request forgery | Exploitation statusNot known exploited | FixYes | Published04/17/2024 | SeverityMedium |
CVE-2024-22354IBM WebSphere Application Server XML external entity injection | Exploitation statusNot known exploited | FixYes | Published04/17/2024 | SeverityHigh |
CVE-2023-50313IBM WebSphere Application Server information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Published04/02/2024 | SeverityMedium |
CVE-2023-35890IBM WebSphere Application Server information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Published07/07/2023 | SeverityMedium |
CVE-2023-27554IBM WebSphere Application Server XML external entity injection | Exploitation statusNot known exploited | FixNot confirmed | Published05/11/2023 | SeverityCritical |
CVE-2022-39161IBM WebSphere Application Server information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Published05/03/2023 | SeverityMedium |
CVE-2023-24966IBM WebSphere Application Server cross-site scripting | Exploitation statusNot known exploited | FixNot confirmed | Published04/27/2023 | SeverityMedium |
CVE-2023-26283IBM WebSphere Application Server cross-site scripting | Exploitation statusNot known exploited | FixNot confirmed | Published03/22/2023 | SeverityMedium |
CVE-2023-23477IBM WebSphere Application Server code execution | Exploitation statusNot known exploited | FixNot confirmed | Published02/03/2023 | SeverityHigh |
CVE-2022-43917IBM WebSphere Application Server information disclosure | Exploitation statusNot known exploited | FixNot confirmed | Published01/25/2023 | SeverityMedium |
CVE-2022-40750IBM WebSphere Application Server cross-site scripting | Exploitation statusNot known exploited | FixNot confirmed | Published11/11/2022 | SeverityMedium |
CVE-2022-35282 | Exploitation statusNot known exploited | FixNot confirmed | Published09/28/2022 | SeverityMedium |
CVE-2022-34336 | Exploitation statusNot confirmed | FixNot confirmed | Published09/13/2022 | SeverityMedium |
CVE-2022-34165 | Exploitation statusNot confirmed | FixNot confirmed | Published09/09/2022 | SeverityMedium |
CVE-2022-22477 | Exploitation statusNot confirmed | FixNot confirmed | Published07/14/2022 | SeverityMedium |
CVE-2022-22473 | Exploitation statusNot confirmed | FixNot confirmed | Published07/14/2022 | SeverityLow |
CVE-2022-22365 | Exploitation statusNot confirmed | FixNot confirmed | Published05/20/2022 | SeverityMedium |
CVE-2021-39038 | Exploitation statusNot confirmed | FixNot confirmed | Published02/24/2022 | SeverityMedium |
CVE-2021-38951 | Exploitation statusNot confirmed | FixNot confirmed | Published12/09/2021 | SeverityHigh |
CVE-2021-29842 | Exploitation statusNot confirmed | FixNot confirmed | Published09/16/2021 | SeverityLow |
CVE-2021-29736 | Exploitation statusNot confirmed | FixNot confirmed | Published07/30/2021 | SeverityMedium |
CVE-2021-29754 | Exploitation statusNot confirmed | FixNot confirmed | Published06/11/2021 | SeverityMedium |
CVE-2021-20492 | Exploitation statusNot confirmed | FixNot confirmed | Published05/26/2021 | SeverityMedium |
CVE-2021-20454 | Exploitation statusNot confirmed | FixNot confirmed | Published04/21/2021 | SeverityHigh |
CVE-2021-20453 | Exploitation statusNot confirmed | FixNot confirmed | Published04/20/2021 | SeverityHigh |
CVE-2021-20480 | Exploitation statusNot confirmed | FixNot confirmed | Published04/08/2021 | SeverityMedium |
CVE-2020-5016 | Exploitation statusNot confirmed | FixNot confirmed | Published03/10/2021 | SeverityMedium |
CVE-2021-20354 | Exploitation statusNot confirmed | FixNot confirmed | Published02/18/2021 | SeverityMedium |
CVE-2021-20353 | Exploitation statusNot confirmed | FixNot confirmed | Published02/10/2021 | SeverityHigh |
CVE-2020-4949 | Exploitation statusNot confirmed | FixNot confirmed | Published01/26/2021 | SeverityHigh |
CVE-2020-4782 | Exploitation statusNot confirmed | FixNot confirmed | Published10/28/2020 | SeverityMedium |
CVE-2020-4576 | Exploitation statusNot confirmed | FixNot confirmed | Published10/01/2020 | SeverityMedium |
CVE-2020-4629 | Exploitation statusNot confirmed | FixNot confirmed | Published09/30/2020 | SeverityLow |
CVE-2020-4643 | Exploitation statusNot confirmed | FixNot confirmed | Published09/21/2020 | SeverityHigh |
CVE-2020-4578 | Exploitation statusNot confirmed | FixNot confirmed | Published09/10/2020 | SeverityMedium |
CVE-2020-4589 | Exploitation statusNot confirmed | FixNot confirmed | Published08/13/2020 | SeverityHigh |
CVE-2020-4534 | Exploitation statusNot confirmed | FixNot confirmed | Published08/03/2020 | SeverityHigh |
CVE-2020-4464 | Exploitation statusNot confirmed | FixNot confirmed | Published07/17/2020 | SeverityHigh |
CVE-2020-4450 | Exploitation statusNot confirmed | FixNot confirmed | Published06/05/2020 | SeverityCritical |
CVE-2020-4449 | Exploitation statusNot confirmed | FixNot confirmed | Published06/05/2020 | SeverityHigh |
CVE-2020-4448 | Exploitation statusNot confirmed | FixNot confirmed | Published06/05/2020 | SeverityCritical |
CVE-2020-4365 | Exploitation statusNot confirmed | FixNot confirmed | Published05/14/2020 | SeverityMedium |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan