CVE-2026-105442 in WebSphere Application Server
Summary
by MITRE • 10/13/2026
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified affects IBM WebSphere Application Server versions 8.5 and 9.0, as well as IBM WebSphere Application Server - Liberty from version 17.0.0.3 through 26.0.0.10. This security flaw resides within the messaging service component of the application server infrastructure. The core technical issue is an insecure deserialization vulnerability that allows a remote attacker to exploit weaknesses in how Java objects are reconstructed from serialized data streams. Insecure deserialization occurs when untrusted data is used during the deserialization process without sufficient validation or sanitization, potentially leading to arbitrary code execution or system compromise. However, in this specific instance, the exploitation vector primarily results in a denial of service condition rather than direct remote code execution.
The operational impact of this vulnerability centers on the availability and stability of the IBM WebSphere Application Server environment. By crafting malicious serialized objects that trigger exceptions or resource exhaustion during the deserialization process within the messaging service, an attacker can cause the application server to crash or become unresponsive. This denial of service disrupts critical business operations that rely on the continuous processing of messages through the WebSphere infrastructure. Since the vulnerability is accessible remotely, it poses a significant risk to any organization exposing their WebSphere messaging endpoints to external networks without adequate protection mechanisms such as strict access control lists or web application firewalls.
From a classification perspective, this flaw aligns with CWE-502, which describes Deserialization of Untrusted Data. This category encompasses vulnerabilities where an attacker can manipulate the state of an object by controlling its serialized form. The attack technique is consistent with MITRE ATT&CK tactic T1190, Exploit Public-Facing Application, as it leverages a vulnerability in software that is exposed to external users or networks. Additionally, the denial of service aspect relates to impact category Impact: Availability under the broader framework of disrupting operational continuity.
Mitigation strategies for this vulnerability involve applying the latest security patches and updates provided by IBM for the affected WebSphere Application Server versions. Organizations should ensure that their development teams adhere to secure coding practices that prevent insecure deserialization, such as using allowlists for expected classes during deserialization rather than relying on blocklists or default behaviors. Furthermore, network-level defenses including firewalls and intrusion prevention systems should be configured to restrict access to the messaging service endpoints only from trusted sources. Regular vulnerability scanning and penetration testing are recommended to identify similar weaknesses in other components of the application server stack before they can be exploited by malicious actors seeking to disrupt services.