Hkcert Multiple Vulnerabilities Found in IBM WebSphere Products
Article Content
- •Multiple vulnerabilities in IBM WebSphere products disclosed on October 15, 2026.
- •CVEs include denial of service and authentication bypass risks with CVSS scores up to 9.8.
- •Affected versions include WebSphere Application Server 8.5, 9.0, and Liberty versions 17.0.0.3 to 26.0.0.10.
On October 15, 2026, IBM disclosed multiple vulnerabilities affecting WebSphere Application Server and WebSphere Application Server Liberty. These include CVE-2026-76646, CVE-2026-68536, CVE-2026-103499, CVE-2026-93907, and CVE-2026-95680, which could allow remote attackers to exploit the systems for denial of service, authentication bypass, and unauthorized access. The vulnerabilities impact versions 8.5, 9.0, and Liberty versions 17.0.0.3 to 26.0.0.10. IBM recommends users apply interim fixes or upgrade to the latest fix packs to mitigate these risks. The CVSS scores range from 7.5 to 9.8, indicating high to severity. The vulnerabilities are not currently reported as but pose significant risks if left unaddressed.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track CVE-2026-103499 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions are affected?
What are the main risks associated with these vulnerabilities?
What should organizations do to protect themselves?
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…