PT-2026-34580 · Ibm · Ibm Websphere Application Server Liberty

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-3621

NVD

CVSS v3.1

7.5

High

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-3621

Affected Products

Ibm Websphere Application Server Liberty

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-3621 · Security Note
• https://twitter.com/knaepp/status/2047022634739576987 · Twitter Post
• https://ibm.com/support/pages/node/7270437 · Patch, Vendor Advisory