CVE-2026-93905 in WebSphere Application Server
Summary
by MITRE • 10/14/2026
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in IBM WebSphere Application Server Liberty versions ranging from 17.0.0.3 to 26.0.0.10 represents a critical integrity failure within the enterprise Java EE batch processing subsystem. This flaw allows an unauthenticated remote attacker to manipulate or corrupt the persisted status of batch job instances without requiring valid credentials. In typical enterprise environments, WebSphere Liberty serves as a robust application server hosting mission-critical business logic, and its batch processing capabilities are often utilized for scheduled data migrations, report generation, and asynchronous task execution. The persistence layer is designed to maintain state across restarts or failures, ensuring that long-running jobs can resume correctly. However, the specific flaw in these versions compromises this mechanism by failing to adequately validate inputs or enforce access controls when updating job status records in the underlying database or file system used for persistence.
From a technical perspective, the root cause lies in insufficient validation of user-supplied data during the update operations of batch job metadata. When an attacker sends specifically crafted requests to the exposed endpoints associated with batch management, they can inject malformed state transitions that bypass internal consistency checks. This leads to the corruption of status fields such as COMPLETED, FAILED, or STOPPED being set incorrectly for active jobs. Because this occurs at the persistence level, the corrupted data is written to disk and remains there even after server restarts, potentially causing cascading failures in dependent systems that rely on accurate job completion signals. The lack of authentication requirement means that any entity with network access to the Liberty instance can exploit this condition, significantly lowering the barrier for entry compared to vulnerabilities requiring prior compromise or valid user sessions.
The operational impact of this vulnerability is severe and multifaceted. First, it disrupts business continuity by rendering batch jobs unreliable; administrators may find that critical scheduled tasks fail silently or report incorrect statuses, leading to data inconsistencies in downstream applications. Second, the corruption of persisted state can lead to resource exhaustion if failed jobs are repeatedly retried due to misinterpreted status codes, causing CPU and memory spikes on the host server. Furthermore, this integrity violation undermines trust in automated workflows, forcing organizations to implement manual interventions for job monitoring and recovery, which increases operational overhead and risk of human error. In regulated industries where audit trails must accurately reflect system activity, such corruption can also lead to compliance violations as logs may not match actual execution states.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code Command Injection in the context of state manipulation, specifically falling under CWE-20 Poor Input Validation and CWE-352 Cross-Site Request Forgery if exploited via browser-based attacks, though it is primarily categorized as a logic flaw leading to data integrity compromise. In terms of MITRE ATT&CK framework, this behavior maps to T1496 Resource Hijacking through denial of service effects caused by corrupted job states and potentially T1505 Server Software Component if the corruption facilitates further exploitation vectors like arbitrary code execution via subsequent interactions with the compromised state machine. The attack vector is classified as Network (ATT&CK T1078) since it requires remote access but no authentication, making it a high-risk exposure for internet-facing deployments or poorly segmented internal networks.
Mitigation strategies must prioritize immediate patching to the latest fixed version of IBM WebSphere Application Server Liberty beyond 26.0.0.10 as provided by IBM in their security advisories. For environments where immediate patching is not feasible, network-level controls should be implemented to restrict access to the batch management endpoints and administrative interfaces only from trusted IP addresses or internal subnets using firewall rules or reverse proxy configurations. Additionally, enabling strict input validation at the application gateway level can help filter out malformed requests before they reach the Liberty server. Organizations should also review their monitoring systems to detect anomalies in job status transitions that deviate from expected patterns, which may indicate active exploitation attempts. Regular audits of batch job logs and database integrity checks are recommended to identify any existing corruption resulting from prior exposure to this vulnerability.