Skip to content
Advisories.
ibmCVE-2026-11538

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.

Low3.7CVE-2026-11538 · Published Sep 18, 2026 · updated Sep 24, 2026

Source advisory

Affected versions

PackageAffectedFixed in
WebSphere Application Server
Vendor
<= 9.0No fix yet
<= 8.5No fix yet
Details and references

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.

CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity from
no source yet
Weakness
CWE-117

More ibm advisories

All
DateAdvisory
Sep 18IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.
CVE-2024-56344Medium5.9no fix yet
Sep 18IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4.
CVE-2025-13882Medium5.3no fix yet
Sep 18IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.
CVE-2025-1350Medium5.3no fix yet
Sep 18IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/..
CVE-2025-14753High7.5no fix yet
Sep 18IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
CVE-2025-14754High8.8no fix yet
Sep 18IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.
CVE-2025-15399Critical10.0no fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.