CVE-2026-103499

CVE-2026-103499 is an unauthenticated denial-of-service flaw (CWE-400, uncontrolled resource consumption) in IBM WebSphere Application Server Liberty and traditional WebSphere Application Server. A remote attacker can trigger it over the network with no privileges and no user interaction, exhausting resources until availability is lost; confidentiality and integrity are not affected (CVSS 3.1 base score 7.5). Affected products are WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 and WebSphere Application Server 8.5 and 9.0, which are widely used as enterprise Java application runtimes. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply the fixes published in IBM security advisory AV26-1040 and upgrade WebSphere Application Server Liberty past 26.0.0.10 and traditional WebSphere Application Server 8.5 and 9.0 to the fixed levels listed in that bulletin. Until patched, limit network exposure of the server (especially to untrusted networks) and watch for sudden CPU, memory, or connection exhaustion from unauthenticated clients.