CVE-2026-93909

waiting for further signals

GHSA-vcr6-887c-vp66 ↗EUVD-2026-100498 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

IBM WebSphere Application Server - Liberty >= 17.0.0.3, <= 26.0.0.10

ETK-2026-1525, permanent identifier

cvss9.1cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

5d 02h 08msince last run

21mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+54h21m

+2h

+4h

+6h

+8h

+10h

description

WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected when the samlWeb-2.0 feature is enabled. A remote attacker may bypass authentication under that configuration.

mitigation

Disable the samlWeb-2.0 feature where it is not required, and limit network access to affected Liberty deployments. Apply vendor remediation when a supported fixed release is identified.

check

exploit

automation

contextual

auth required

EPSS

0.35%27th percentile

agent run time

21m

cve.org record, t = 0

2026-10-13 20:18Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-13 20:18Z
ghsa: trigger signal, started the run
https://github.com/advisories/GHSA-vcr6-887c-vp66
2026-10-13 20:18Z
cve.org record for CVE-2026-93909
cve_org · https://www.cve.org/CVERecord?id=CVE-2026-93909

this entry in the feed

GET /api/v1/feed/CVE-2026-93909

{
  "etk_id": "ETK-2026-1525",
  "cve_id": "CVE-2026-93909",
  "display_id": "CVE-2026-93909",
  "ghsa_id": "GHSA-vcr6-887c-vp66",
  "euvd_id": "EUVD-2026-100498",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in WebSphere Application Server Liberty",
  "summary": "WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected when the samlWeb-2.0 feature is enabled. A remote attacker may bypass authentication under that configuration.",
  "mitigation": "Disable the samlWeb-2.0 feature where it is not required, and limit network access to affected Liberty deployments. Apply vendor remediation when a supported fixed release is identified.",
  "vendor": "IBM",
  "product": "WebSphere Application Server - Liberty",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 17.0.0.3, <= 26.0.0.10"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "WebSphere Application Server - Liberty",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0035,
  "epss_percentile": 0.2772,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.66359115,
  "t0_at": "2026-10-13T20:18:18.736000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-13T20:18:18.736000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T20:18:18.736000+00:00",
      "url": "https://github.com/advisories/GHSA-vcr6-887c-vp66"
    }
  }
}

published 2026-10-14 00:54Z
last change 2026-10-21 04:45Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.