IBM security advisory (AV26-1040)
Canadian Cyber Centre warns IBM WebSphere and Liberty face denial of service via CVE-2026-103499.
On October 14, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1040 covering IBM product vulnerabilities. IBM WebSphere Application Server (8.5 and 9.0 and earlier) and WebSphere Application Server Liberty (through 26.0.0.10) are affected by denial-of-service flaw CVE-2026-103499. The notice also lists mcp-context-forge through 1.0.2 and tells administrators to apply updates as they become available. No exploitation is reported.
- CVE-2026-103499 is a denial-of-service flaw in WebSphere Application Server and Liberty.
- Affected WAS releases are 8.5 and 9.0 and earlier; Liberty through 26.0.0.10.
- mcp-context-forge through version 1.0.2 is also listed as affected.
- The Cyber Centre urges administrators to review IBM links and apply updates.
- CVEs
- CVE-2026-103499
- Vendors
- IBM
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103499 | Unauthenticated DoS in IBM WebSphere Application Server | 7.5 | — |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1040 Date: October 14, 2026 As of October 13, 2026, IBM is affected by vulnerabilities in the following products: WebSphere Application Server Prior to or equal to 8. 5 Prior to or equal to 9. 0 WebSphere Application Server - Liberty Prior to or equal to 26.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.