CVE-2026-3621

published 2026-04-23

CVE-2026-3621: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited…

Priority P4 34 medium 5.9 CVSS 3.1

AV N AC H PR N UI N S U C N I H A N

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
ibm	websphere_application_server	>= 17.0.0.3 < 26.0.0.5	26.0.0.5
ibm	websphere_application_server_liberty	17.0.0.3 – 26.0.0.4	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-269