CVE-2026-93895

Summary

IBM WebSphere Liberty servers are vulnerable to an authentication bypass that allows unauthenticated attackers to access gRPC service methods configured with specific access controls. This critical flaw means attackers can gain unauthorized access to protected services without needing credentials.

Exploitability

The exploit is straightforward and requires no authentication or user interaction, making it highly attractive to attackers who can reach the affected gRPC endpoints.

Blast radius

The impact could be significant across all applications using affected Liberty versions, potentially exposing sensitive gRPC services to unauthorized access and data leakage.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM WebSphere Application Server - Liberty 26.0.0.11 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.