IBM has issued fixes for four vulnerabilities in IBM WebSphere Application Server Liberty, including two critical flaws that could enable remote authentication or access-control bypass. The vulnerabilities are CVE-2026-93895 and CVE-2026-93909, both rated CVSSv3.1 at 9.1. A separate gRPC-related issue, CVE-2026-95695 (7.4) and CVE-2026-95696 (6.5), affect the same Liberty product when the grpc-1.0 feature is enabled.
The publication notes that these flaws could be exploited over the network without user interaction or credentials, with the highest impact described as an improper access control in Liberty’s gRPC and a critical session-handling flaw for SAML.
Affected products and versions vary by feature. CVE-2026-93895, CVE-2026-95695 and CVE-2026-95696 apply to IBM WebSphere Application Server Liberty versions 20.0.0[.]12 through 26.0.0[.]10 with grpc-1.0 enabled. CVE-2026-93909 affects Liberty versions 17.0.0[.]3 through 26.0.0[.]10 with the samlWeb-2.0 feature enabled.
IBM recommends applying interim fixes for APAR DT502929 (grpc-1.0) or DT502359 (samlWeb-2.0) immediately, or upgrading to WebSphere Liberty Fix Pack 26.0.0[.]11 or later when it becomes available in Q4 2026. The article notes there is no confirmed exploitation at the time of reporting.