CVE-2026-93895 IBM CVE debrief

Who should care

Liberty server administrators, security teams, and IT personnel responsible for WebSphere Application Server - Liberty deployments should be aware of this vulnerability and take immediate action to prevent potential unauthorized access and data breaches. They should review and apply IBM patches, verify access controls on gRPC service methods, and monitor for potential unauthorized access attempts.

Why it matters

This vulnerability requires immediate attention from Liberty server administrators and security teams to prevent potential unauthorized access and data breaches. Affected deployments should prioritize patching and verifying access control configurations.

• Potential unauthorized access to sensitive data
• Bypass of access controls on gRPC service methods
• Possible lateral movement within affected Liberty server environments
• Verification of access control configurations required

Technical summary

The vulnerability allows unauthenticated remote attackers to bypass access controls configured on gRPC service methods in IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10. This could allow an attacker to access sensitive data or perform lateral movement within affected Liberty server environments. Affected deployments should prioritize patching and verifying access control configurations.

Defensive priority

High priority for Liberty server administrators and security teams

Recommended defensive actions

• Review and apply IBM patch for affected Liberty server versions
• Verify access controls on gRPC service methods
• Monitor for potential unauthorized access attempts

Evidence notes

Official CVE Program record and NVD vulnerability detail page confirm the vulnerability. IBM provides a vendor advisory with patch information. The CVE record was published on 2026-10-13T20:18:07.987Z and has not been modified since then. The official advisory provides patch information for affected Liberty server versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.