CVE-2026-101294
Awaiting Analysis Awaiting Analysis - Queue

Improper Cryptographic Signature Verification in IBM WebSphere Application Server

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: IBM Corporation

Description
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-14
EPSS Evaluated
2026-10-18
NVD
CVE-2026-101294
EUVD
EUVD-2026-100494

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
IBM WebSphere Application Server - Liberty 17.0.0.3
IBM WebSphere Application Server 8.5
IBM WebSphere Application Server 9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-325 The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a remote attacker to bypass cryptographic signature verification in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server versions 8.5 and 9.0 due to improper verification of cryptographic signatures.

Impact Analysis

An attacker could exploit this to bypass security controls, potentially allowing unauthorized access to sensitive data or execution of malicious code on affected systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access or exposure, as it undermines cryptographic protections required for data integrity and confidentiality.

Mitigation Strategies

Update IBM WebSphere Application Server - Liberty to a version beyond 26.0.0.10 or IBM WebSphere Application Server to versions beyond 8.5 and 9.0 to address the improper cryptographic signature verification issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101294. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart