IBM WebSphere Application Server Liberty access control, authorization and DoS flaws (CVE-2026-93895, CVE-2026-95695, CVE-2026-95696)

What happened

The most severe issue is CVE-2026-93895, an improper access control flaw. An unauthenticated remote attacker can reach affected Liberty servers over the network and bypass access controls configured on gRPC service methods, potentially interacting with service functions and data without credentials. IBM rates the vulnerability critical with a CVSS 9.1 vector: network, low complexity, no privileges or user interaction, with high confidentiality and integrity impact.

CVE-2026-95695 is a separate incorrect authorization flaw. A remote attacker can bypass security restrictions, again without credentials. The CVSS score is 7.4, and the attack is rated high complexity, with high confidentiality and integrity impact if exploited.

CVE-2026-95696 allows a remote attacker to cause a denial of service through an uncaught exception. It has a CVSS 6.5 score with low confidentiality and availability impact. None of the three is reported as exploited or publicly disclosed, and there is no CISA KEV entry for them.

Who is affected

IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10 are affected. This is IBM's application server product. Organisations should treat any internet-facing Liberty instance, and any instance reachable from less-trusted internal networks, as exposed because all three flaws are reachable remotely without prior authentication.

What to do now

1. Apply IBM's fix. IBM has published a fix for this advisory; refer to IBM support page node 7292228 for the fixed release. The CVE records do not state a specific fixed version number.
2. Until patching is complete, restrict network access to Liberty gRPC endpoints so that only trusted clients can reach them.
3. Review access control and authorization configuration on gRPC service methods in affected Liberty deployments.
4. Monitor affected instances for uncaught exceptions or repeated service disruption, which could indicate attempted exploitation of the denial-of-service flaw.

How to detect it

The CVE records do not include vendor-provided indicators of compromise. Start by inventorying WebSphere Application Server Liberty instances with gRPC endpoints reachable from untrusted networks, and review their service method access controls. Monitor for uncaught exceptions or repeated service disruption on affected instances.

Beyond the patch

These are network-reachable, no-credential flaws on an application server, so the immediate gap is exposure: which Liberty instances and gRPC endpoints can be reached, and from where. Our Virtual CISO Services (vCISO) helps you map and prioritise that exposure, while Supply Chain Defense & Third-Party Risk tracks how quickly a supplier such as IBM closes issues across your estate. Patch first, then use the same visibility to narrow the attack path for the next bulletin.