CVE-2026-3621 HIGH

CVE-2026-3621: IBM WebSphere Application Server Liberty is affected by identity spoofing

Vendor Ibm
Product WebSphere Application Server - Liberty
Weakness CWE-269
Published April 22, 2026
Last update April 24, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.

Key dates

02Disclosure timeline

April 22, 2026 CVE published
April 24, 2026 Record updated