IBM WebSphere Products Multiple Vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities have been identified.

Who is affected

Users of IBM WebSphere products are affected.

Urgency

Remediation is necessary as vulnerabilities could be exploited in the future.

Action

Monitor for updates from IBM.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

HKCERT Security Bulletins (HK · national-cert · site)

Severity

unknown

Published

2026-07-02

Exploitation

Not in CISA KEV at last sync

Original advisory: https://www.hkcert.org/security-bulletin/ibm-websphere-products-multiple-vulnerabilities_20260702

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-90060.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all scored CVEs.
• Low exploitation riskCVE-2026-115460.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all scored CVEs.
• Low exploitation riskCVE-2026-115950.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all scored CVEs.
• Low exploitation riskCVE-2026-117080.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
• Low exploitation riskCVE-2026-117120.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
• Low exploitation riskCVE-2026-117140.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all scored CVEs.
• Low exploitation riskCVE-2026-506450.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• medium[UPDATE] [medium] Apache CXF: Multiple vulnerabilitiescert-bund
• unknownMultiple vulnerabilities in IBM products (July 10, 2026)cert-fr-avis
• unknownMultiple vulnerabilities in IBM products (July 3, 2026)cert-fr-avis
• high[UPDATE] [high] IBM WebSphere Application Server: Multiple vulnerabilitiescert-bund
• high[UPDATE] [high] IBM WebSphere Application Server: Multiple vulnerabilitiescert-bund
• high[NEW] [high] IBM WebSphere Application Server Liberty: Multiple vulnerabilitiescert-bund
• highCVE-2026-11714: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-s…nvd
• criticalCVE-2026-11712: IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerabil…nvd
• criticalCVE-2026-11708: IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerabil…nvd
• mediumCVE-2026-11595: IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitiv…nvd
• highCVE-2026-11546: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-s…nvd

Recent advisories for IBM WebSphere Products

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• unknownIBM WebSphere Products Multiple Vulnerabilitieshkcert · 2026-06-24

More from HKCERT Security Bulletins

• unknownGoogle Chrome Multiple Vulnerabilities2026-07-09
• unknownJuniper Junos OS Multiple Vulnerabilities2026-07-09
• unknownPalo Alto Products Multiple Vulnerabilities2026-07-09
• unknownBeyondTrust Products Multiple Vulnerabilities2026-07-08
• unknownApple Products Multiple Vulnerabilities2026-07-06