rootpwn

medium · CVSS v3 6.5

CVE-2026-11549

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerab…

Description

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability.

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
6.5
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-11539

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to an authentication bypass in the SOAP/JMX connector, allowing attackers to gain unauthorized access to JMX services and potentially expose sensitive configuration data. The flaw is relevant for organizations running these versions in production environments.

View analysis

medium

CVE-2026-11540

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to a remote information disclosure via the FileTransfer servlet. An attacker can retrieve sensitive file system details without authentication. This flaw can aid reconnaissance or further attacks.

View analysis

medium

CVE-2026-11548

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.

View analysis