4.3
Medium
CVE-2026-78636 IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
Description
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WebSphere Application Server - Liberty 17.0 | 17.0.0.3 → 26.0.0.10 | No fix stated |
Other CVEs of WebSphere Application Server - Liberty
The 57 CVEs of WebSphere Application Server - Liberty →
CVE-2026-11547
IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
4.3
Medium
CVE-2026-10844
IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
4.3
Medium
CVE-2026-108284
IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
6.5
Medium
CVE-2026-103320
IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
4.3
Medium