External risk intelligence

IBM WebSphere Liberty gRPC Access Control Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-93895

IBM WebSphere Application Server is frequently deployed as an internet-facing web application or API gateway. gRPC services are commonly used in external-facing service architectures, making them reachable in many public-facing production environments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in IBM WebSphere Application Server - Liberty that could allow unauthorized access to certain services. The issue stems from a flaw in how access controls are managed for gRPC services, potentially enabling unauthenticated remote attackers to bypass these protections and gain unauthorized access. The main concern is confirming relevance and exposure given the technology's common use in external-facing architectures.

Unauthenticated access to protected services.
Affects internet-facing systems using specific IBM software.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could remotely send specially crafted requests to a vulnerable IBM WebSphere Application Server Liberty instance that expose gRPC services. If these requests are not properly validated, the attacker may be able to bypass access controls and gain unauthorized access to methods within those services.

Unauthenticated remote access required.
Attacker triggers vulnerability by sending requests.
Risk of unauthorized access to service methods.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could bypass access controls for gRPC service methods in IBM WebSphere Application Server - Liberty. This could expose sensitive information or allow unauthorized modifications to data when the service is configured to handle such requests.

System data or user data.
Bypassing access controls on gRPC methods.
Unauthorized access to system resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in IBM WebSphere Application Server - Liberty, which allows unauthenticated remote attackers to bypass access controls on gRPC services, requires swift action from platform or application owners. The first practical step is to inventory all instances of the affected WebSphere Application Server - Liberty, determine their exposure (especially internet-facing or those handling sensitive data), identify the business-criticality and accountable owner, and then plan remediation based on the assessed risk.

Platform or application owners should address this.
Verify gRPC service accessibility and business criticality.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM WebSphere Application Server - Liberty?

It is a lightweight, modular Java application server used to build, deploy, and run cloud-native applications and microservices. Because it supports modern communication protocols like gRPC, organizations use it as an API gateway or backend service host to facilitate interaction between different parts of a distributed software system.

How does CVE-2026-93895 allow access control bypass?

This vulnerability is classified as Improper Access Control (CWE-284). It occurs when the server fails to correctly enforce security checks on incoming gRPC service requests. Essentially, the software's gatekeeping logic for these specific methods is flawed, allowing unauthorized remote users to interact with services they should be blocked from accessing.

What must an attacker do to trigger this vulnerability?

An attacker must send specifically crafted network requests to the vulnerable Liberty instance that target gRPC service methods. The vulnerability is not triggered by standard, legitimate traffic that is already permitted; it specifically requires requests designed to exploit the gap in the server's internal authorization logic.

Do I need to worry if my service is not internet-facing?

According to Halo Surface Signal, this software is often used in external-facing architectures, which increases the likelihood of reachability. However, if your Liberty instance is strictly internal and isolated from public networks, the attack surface is significantly reduced compared to instances directly exposed to the internet.

When should I begin responding to this CVE?

You should start by identifying all deployed instances of WebSphere Liberty and confirming which ones utilize gRPC services. Prioritize your inventory based on whether these instances are internet-facing or handle sensitive business data. Once you have a clear scope, schedule a maintenance window to apply the necessary security updates.

References

www.ibm.com/support/pages/node/7292228

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.