Cryptographic Signature Verification Bypass in IBM WebSphere Application Server
CVE-2026-101294

8.7HIGH

Key Information:

Vendor

IBM
Status
Websphere Application Server - Liberty
Websphere Application Server
Vendor
CVE Published:
13 October 2026

What is CVE-2026-101294?

A vulnerability has been identified in IBM WebSphere Application Server that allows a remote attacker to bypass the cryptographic signature verification process. This issue arises from improper handling of the verification mechanism, potentially exposing affected systems to unauthorized access or exploitation. Users are strongly advised to review the vendor's advisory and apply the necessary patches to mitigate the risk associated with this vulnerability.

Affected Version(s)

WebSphere Application Server 8.5

WebSphere Application Server 9.0

WebSphere Application Server - Liberty 17.0.0.3 <= 26.0.0.10

References

https://www.ibm.com/support/pages/node/7292235
vendor-advisorypatch

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.