External risk intelligence

IBM WebSphere Liberty Security Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-95695

IBM WebSphere Application Server Liberty is commonly deployed as an internet-facing application server, web middleware, or API gateway. These roles frequently involve hosting services that are directly reachable via public network interfaces to support web applications and external service communication.

Ibm Websphere Application Server

20.0.0.12 to before 26.0.0.11

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

IBM WebSphere Application Server - Liberty has a vulnerability that could allow unauthorized access due to incorrect authorization. This affects systems using specific versions of the software, and while its impact is rated critical, the main concern is to confirm if our environment is exposed.

Access bypass due to incorrect authorization.
Critical severity, external exposure risk.
Confirm relevance and our exposure.

Attack Path

How an attacker could exploit the issue

An attacker could remotely access an IBM WebSphere Application Server Liberty instance that is exposed to the network. By exploiting an authorization flaw, the attacker could bypass security measures to access sensitive information or manipulate data.

Network access required.
Vulnerable authorization check.
Bypass security, access data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass security controls when the application server is configured to allow unauthenticated access to sensitive functions. When supported by the advisory, this may affect system data and application behavior.

Bypass of security restrictions.
Unauthenticated network access.
Unauthorized access to system data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for IBM WebSphere Application Server Liberty deployments, including application owners and infrastructure or platform teams, must prioritize identifying all instances of the affected software. The initial focus should be on confirming exposure, understanding business criticality, and identifying the accountable owner to inform a risk-based remediation plan.

Application and platform teams own the issue.
Verify internet reachability and business criticality.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM WebSphere Application Server Liberty?

It is a lightweight, modular Java application server designed for building, deploying, and running cloud-native applications and microservices. Organizations typically use it as middleware or an API gateway to host web applications that need to communicate with external services or end users.

What does incorrect authorization mean for CVE-2026-95695?

This vulnerability, classified as CWE-863 (Incorrect Authorization), means the software fails to properly verify if a user has permission to access a specific resource or function. In the context of this CVE, it allows an attacker to bypass security restrictions that should have blocked their request, potentially letting them view or modify data they are not authorized to handle.

How does an attacker trigger this security bypass?

The flaw is triggered when an attacker sends a specially crafted network request to the application server. The vulnerability is not dependent on specific user interactions; however, it is important to note that the issue relies on the server's authorization logic being bypassed. Requests that do not attempt to access protected functions or paths are not affected by this specific authorization weakness.

Is my IBM WebSphere instance at risk?

According to Halo Surface Signal, this software is frequently deployed in internet-facing roles like API gateways or web middleware. If your instance is directly reachable via a public network interface, it faces a higher external risk. Systems confined to internal, private networks are generally at lower risk of this specific network-based attack vector.

What should I do if I run WebSphere Liberty?

First, inventory your environment to locate all instances of the affected software versions. Once identified, evaluate whether these servers are accessible from the internet and determine the sensitivity of the applications they host. Use this information to prioritize your patching plan and coordinate with your platform and application teams to apply the necessary updates.

References

www.ibm.com/support/pages/node/7292228

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.