IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Ibm
  • Cics Tx Advanced
  • Websphere Application Server
  • Websphere Application Server Liberty

No data.

No data.

References
Link Providers
https://www.ibm.com/support/pages/node/7286610 cve-icon cve-icon
https://www.ibm.com/support/pages/node/7286611 cve-icon cve-icon
History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server 8.5 and 9.0 are affected by a virtual host bypass vulnerability. IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability.
Title IBM WebSphere Application Server IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access Control
First Time appeared Ibm websphere Application Server Liberty
CPEs cpe:2.3:a:ibm:websphere_application_server_liberty:17.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.8:*:*:*:*:*:*:*
Vendors & Products Ibm websphere Application Server Liberty
References

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability. IBM WebSphere Application Server 8.5 and 9.0 are affected by a virtual host bypass vulnerability.
Title Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced. IBM WebSphere Application Server
First Time appeared Ibm websphere Application Server
CPEs cpe:2.3:a:ibm:cics_tx_advanced:10.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cics_tx_advanced:10.1:*:*:*:*:*:*:*		 cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*
Vendors & Products Ibm websphere Application Server
References

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability.
Title Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.
First Time appeared Ibm
Ibm cics Tx Advanced
Weaknesses CWE-284
CPEs cpe:2.3:a:ibm:cics_tx_advanced:10.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cics_tx_advanced:10.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm cics Tx Advanced
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2026-09-18T19:06:17.198Z

Updated: 2026-10-22T18:53:28.715Z

Reserved: 2026-06-08T03:27:16.708Z

Link: CVE-2026-11549

cve-icon Vulnrichment

Updated: 2026-09-18T19:45:34.492Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-18T20:17:00.923

Modified: 2026-10-22T19:17:49.217

Link: CVE-2026-11549

cve-icon Redhat

No data.