IBM week 42 2026: critical WebSphere Liberty and Db2 Mirror for i flaws lead 30 CVEs

The release at a glance

IBM's security release for the week of 12 October to 18 October 2026 comprises 30 CVEs across Db2, Db2 Mirror for i, Db2 Genius Hub, DB2 Recovery Expert, WebSphere Application Server and WebSphere Application Server - Liberty. By severity, the set includes 3 critical, 11 high, 14 medium and 2 low findings. None of the 30 CVEs is listed in CISA's Known Exploited Vulnerabilities catalogue, and none is marked as exploited in the IBM advisories. The critical items sit in Db2 Mirror for i and WebSphere Application Server - Liberty; high-severity issues also affect Db2 and WebSphere Application Server. WebSphere Application Server - Liberty accounts for 13 of the CVEs, Db2 for 7, DB2 Recovery Expert for 4, WebSphere Application Server for 3, Db2 Genius Hub for 2, and Db2 Mirror for i for 1.

What matters most

At the top of the list is CVE-2026-96012 in Db2 Mirror for i 7.4, 7.5 and 7.6, scored 9.9 critical. An authenticated attacker can craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code and obtain elevated privileges; it has its own advisory page on this site. In Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5, CVE-2026-105465 and CVE-2026-105464 are both local privilege-escalation flaws scored 8.8 high. CVE-2026-105465 requires db2locssh to be enabled with the Db2 instance, while CVE-2026-105464 allows a local attacker with DBADM authorization to gain elevated privileges.

WebSphere Application Server - Liberty carries two critical access-control issues. CVE-2026-93895 (9.1) allows an unauthenticated remote attacker to bypass access controls configured on gRPC service methods, affecting Liberty 20.0.0.12 through 26.0.0.10. CVE-2026-93909 (9.1) is an authentication bypass when the samlWeb-2.0 feature is enabled, affecting Liberty 17.0.0.3 through 26.0.0.10. Also in Liberty 17.0.0.3 through 26.0.0.10, CVE-2026-93905 (8.2) lets an unauthenticated remote attacker corrupt the persisted status of batch job instances. CVE-2026-101294 (8.7) is a missing cryptographic signature verification flaw affecting Liberty 17.0.0.3 through 26.0.0.10 and WebSphere Application Server 8.5 and 9.0.

WebSphere Application Server 8.5 and 9.0 also has CVE-2026-93907 (8.1), a remote authentication bypass through the CSIv2 inbound propagation handler.

Patch in this order

1. Patch WebSphere Application Server - Liberty first, especially internet-facing deployments. CVE-2026-93895 and CVE-2026-93909 are critical and reachable without authentication over the network; if you use gRPC or samlWeb-2.0, move these first. CVE-2026-93905 is also unauthenticated and high severity. IBM has fixes available; the advisory pages list the relevant fix packs.
2. Patch Db2 Mirror for i 7.4, 7.5 and 7.6 for CVE-2026-96012, the critical privilege-escalation flaw. Give priority to systems where authenticated users can be numerous or where the database tier is exposed to applications that cannot be fully trusted.
3. Patch WebSphere Application Server 8.5 and 9.0 for CVE-2026-93907 and CVE-2026-101294.
4. Patch Db2 11.5 and 12.1 for CVE-2026-105465 and CVE-2026-105464. These are local privilege escalations, so treat hosts with shared logins or broad local access as higher priority.
5. Schedule the remaining high and medium CVEs in the normal change window, prioritising any externally reachable Db2 Genius Hub, DB2 Recovery Expert or WebSphere components in your estate.

Beyond the patch

A 30-CVE week across six IBM products is more manageable when you can see which systems are actually reachable before patching and which privileged actions are being attempted. Virtual CISO Services (vCISO) helps you map exposed WebSphere, Db2 and Db2 Mirror for i services, and Managed Detection & Response (MDR) watches for privilege escalation and access-control abuse if a fix is delayed.