IBM WebSphere Application Server - Liberty 17 is affected by CVE-2026-93909, rated 9.1 (critical). No in-the-wild exploitation has been confirmed in the CISA KEV catalog at the time of writing.
What the flaw is
The NIST National Vulnerability Database describes it as follows:
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
At a glance
| Field | Detail |
|---|---|
| CVE | CVE-2026-93909 |
| Affected product | IBM WebSphere Application Server - Liberty 17 |
| Weakness | CWE-384 |
| CVSS | 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
What defenders should do
- Patch: apply the fixed release from IBM; check the vendor advisory linked below for the exact versions.
- Inventory: identify every instance of IBM WebSphere Application Server - Liberty 17, prioritising internet-facing ones.
