ibmCVE-2026-11545

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks.

Low3.7CVE-2026-11545 · Published Sep 18, 2026 · updated Sep 22, 2026

Affected versions

Package	Affected	Fixed in
WebSphere Application Server Vendor	<= 8.5	No fix yet
	<= 9.0	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from: no source yet
Weakness: CWE-862

More ibm advisories

All

Date	Advisory	Severity	Fixed in
Sep 18	IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1. CVE-2024-56344Medium5.9no fix yet	Medium5.9	No fix yet
Sep 18	IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4. CVE-2025-13882Medium5.3no fix yet	Medium5.3	No fix yet
Sep 18	IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1. CVE-2025-1350Medium5.3no fix yet	Medium5.3	No fix yet
Sep 18	IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/.. CVE-2025-14753High7.5no fix yet	High7.5	No fix yet
Sep 18	IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input. CVE-2025-14754High8.8no fix yet	High8.8	No fix yet
Sep 18	IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0. CVE-2025-15399Critical10.0no fix yet	Critical10.0	No fix yet

Affected versions

More ibm advisories

Critical advisories by email