IBM WebSphere Application Server Liberty: Deserialization of untrusted data in batch
Summary
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected when the batchManagement-1.0 feature is enabled. An unauthenticated remote attacker can exploit the flaw over the network without user interaction to corrupt the persisted status of batch job instances. According to IBM, the impact is limited to integrity (high) and availability (low), with no confidentiality impact.
Affected
- IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10
- Relevant when the batchManagement-1.0 feature is enabled
Fixed in
- Interim fix that resolves APAR DT502467, applied on top of the minimum fix pack level it requires
- Liberty Fix Pack 26.0.0.11 or later (targeted availability 4Q2026 according to IBM)
Workaround
None listed by IBM.
Exploitation
- No public exploitation known at the time of publication.
- CISA SSVC assessment: Exploitation none, Automatable yes, Technical Impact partial.
Our recommendation
- Inventory all Liberty servers and their versions, and check whether the batchManagement-1.0 feature is enabled.
- Prioritise internet-facing servers and servers with batch management enabled.
- Apply the interim fix for APAR DT502467 or upgrade to Fix Pack 26.0.0.11 or later as soon as it is available, and check the IBM bulletin for the exact build.
- Disable the batchManagement-1.0 feature where it is not needed.
- Monitor the IBM bulletin, NVD and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin for CVE-2026-93905 www.ibm.com
- VulnRichment entry for CVE-2026-93905 vulners.com
- CVE-2026-93905 at CVE.threatint.com cve.threatint.com
- CVE-2026-93905 at Strix www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:27.
Original description (NVD)
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.