Denial of Service Vulnerability in IBM WebSphere Application Server
CVE-2026-103499

7.5HIGH

Key Information:

Vendor

IBM
Status
Websphere Application Server - Liberty
Websphere Application Server
Vendor
CVE Published:
13 October 2026

What is CVE-2026-103499?

A vulnerability exists in IBM WebSphere Application Server and its Liberty editions, which could allow remote unauthenticated attackers to exploit uncontrolled resource consumption. This flaw has the potential to lead to a denial of service condition, affecting the availability of applications running on the server. It is crucial for affected users to apply necessary patches and updates to mitigate this risk and ensure the security and stability of their systems.

Affected Version(s)

WebSphere Application Server 8.5

WebSphere Application Server 9.0

WebSphere Application Server - Liberty 17.0.0.3 <= 26.0.0.10

References

https://www.ibm.com/support/pages/node/7292214
vendor-advisorypatch

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.