CVE-2026-93895

CRITICAL 9.1CVE-2026-93895 · Published 13/10/2026 · updated 22/10/2026

In short

CVE-2026-93895 is a CRITICAL (CVSS 9.1) vulnerability affecting websphere application server (ibm).
Chance of exploitation in the next 30 days (EPSS): 0.39%, higher than 33.7% of all vulnerabilities.
Fix: update to 26.0.0.11 or later.

Package	Affected versions	Patched versions
websphere application server ibm	`≥ 20.0.0.12, < 26.0.0.11`	`26.0.0.11`

Description

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.

References

ibm.com/support/pages/node/7292228 · Vendor Advisory

More vulnerabilities in websphere application server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

websphere application server

ibm

≥ 20.0.0.12, < 26.0.0.11

26.0.0.11

More vulnerabilities in websphere application server

See all →