IBM WebSphere Application Server Liberty: Improper access control between servers
Summary
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 do not sufficiently isolate servers that share one installation. The flaw applies when the restConnector-1.0 or restConnector-2.0 feature is enabled. An attacker with low privileges on one server could affect the confidentiality and integrity of other servers on the same installation, and the attack complexity is high with no user interaction required.
Affected
- IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10
- Relevant only when the restConnector-1.0 or restConnector-2.0 feature is enabled
- Products that bundle Liberty may also be affected
Fixed in
- Upgrade to the minimum fix pack level required by the interim fix, then apply the interim fix for APAR DT503659
- Liberty Fix Pack 26.0.0.11 or later (targeted availability 4Q2026 according to IBM)
Workaround
Unknown. IBM lists no workarounds or mitigations.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept found.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether restConnector-1.0 or restConnector-2.0 is enabled on your Liberty servers, using IBM's feature determination guidance.
- Check whether several Liberty servers share one installation.
- Apply the interim fix for DT503659 now, or Fix Pack 26.0.0.11 or later once it is available; confirm availability on IBM Fix Central.
- Restrict local access to shared installations.
- Monitor Liberty server logs for unusual activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin CVE-2026-105443 www.ibm.com
- Strix CVE-2026-105443 product listing and status www.strix.ai
- CVE record CVE-2026-105443 cve.threatint.com
- Third-party copy of IBM advisory with fix details cve.imfht.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:28.
Original description (NVD)
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.