IBM Websphere Application Server
153 CVEs affecting IBM Websphere Application Server. Latest disclosed: 2026-08-05. Critical: 14, High: 51.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14512 | Critical | 9.8 | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to byp… |
CVE-2026-14446 | Critical | 9.8 | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console. |
CVE-2020-4589 | Critical | 9.8 | 2020-08-13 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence… |
CVE-2020-4450 | Critical | 9.8 | 2020-06-05 | IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequenc… |
CVE-2020-4448 | Critical | 9.8 | 2020-06-05 | IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a special… |
CVE-2019-4279 | Critical | 9.8 | 2019-05-17 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of seriali… |
CVE-2018-1567 | Critical | 9.8 | 2018-09-07 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through the SOAP connector with a serialize… |
CVE-2026-14529 | Critical | 9.4 | 2026-07-29 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side… |
CVE-2026-11712 | Critical | 9.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system. |
CVE-2026-11708 | Critical | 9.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system. |
CVE-2026-8644 | Critical | 9.1 | 2026-06-01 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing. |
CVE-2026-9319 | Critical | 9.0 | 2026-06-01 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints wi… |
CVE-2026-9311 | Critical | 9.0 | 2026-06-01 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls. |
CVE-2025-36038 | Critical | 9.0 | 2025-06-25 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of seriali… |
CVE-2024-37532 | High | 8.8 | 2024-06-20 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID… |
CVE-2021-29736 | High | 8.8 | 2021-07-30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system. IBM X-Force ID: 201300. |
CVE-2021-29754 | High | 8.8 | 2021-06-11 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when using the SAML Web Inbound Trust Association… |
CVE-2020-4534 | High | 8.8 | 2020-08-03 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by imprope… |
CVE-2020-4464 | High | 8.8 | 2020-07-17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafte… |
CVE-2020-4362 | High | 8.8 | 2020-04-10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication… |