CVE-2026-18499
Received Received - Intake

Privilege Escalation in IBM WebSphere Liberty

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: IBM Corporation

Description
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-18499
EUVD
EUVD-2026-57322

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm websphere_application_server_liberty From 17.0.0.3 (inc) to 26.0.0.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 are vulnerable to privilege escalation when using Liberty collectives. The issue occurs when the collectiveController-1.0 or collectiveMember-1.0 features are enabled, allowing unauthorized privilege escalation due to improper authorization.

Detection Guidance

Check if the collectiveController-1.0 or collectiveMember-1.0 features are enabled in IBM WebSphere Application Server Liberty. Review server configuration files for these features in the enabledFeatures section.

Impact Analysis

This vulnerability could allow attackers to gain elevated privileges on affected systems, potentially leading to unauthorized access, data manipulation, or further compromise of the environment. The high CVSS score of 8.1 indicates significant risk.

Mitigation Strategies

Apply the interim fix for APAR DT497580 or upgrade to Liberty Fix Pack 26.0.0.9. Disable the vulnerable features if they are not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18499. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart