IBM WebSphere Liberty gRPC Flaw Lets Unauthenticated Attackers Evade Access Controls

IBM WebSphere Application Server - Liberty contains a severe security flaw that allows remote attackers to bypass access controls. The issue affects gRPC service methods within the application server. According to the National Vulnerability Database, an unauthenticated attacker could exploit this weakness to gain unauthorized access. This vulnerability is tracked as CVE-2026-93895 and impacts specific version ranges of the software.

The risk

The core issue involves improper access control on gRPC services. The National Vulnerability Database describes the weakness using CWE-284. An attacker does not need valid credentials to attempt this bypass. Remote exploitation is possible without prior authentication. The flaw allows bypassing configured security methods on the service level. This creates a direct path for unauthorized interaction with the server.

Who is exposed

IBM WebSphere Application Server - Liberty versions from 20.0.0.12 through 26.0.0.10 are affected. Any organization running these specific builds faces exposure. The National Vulnerability Database confirms the version range for this critical issue. Environments using older or newer versions outside this specific window are not listed as affected. Teams must verify their current installation version against this range.

Cost and compliance

The National Vulnerability Database assigns a CVSS score of 9.1 to CVE-2026-93895. This score places the vulnerability in the critical severity category. Organizations relying on compliance frameworks that mandate timely patching of critical flaws must address this. The high score indicates a significant potential impact on confidentiality, integrity, or availability. No specific financial penalties are mentioned in the source material.

What to watch

Security teams should immediately audit their IBM WebSphere Liberty installations. Verify the current version against the affected range of 20.0.0.12 through 26.0.0.10. Monitor network traffic for unusual gRPC activity that lacks proper authentication headers. Review access logs for successful method calls from unknown sources. Prepare to isolate affected systems if exploitation is suspected.

Signals worth monitoring

Teams usually review application logs for unexpected gRPC method invocations. Check whether access control logs show bypass attempts from unauthenticated sources. Look for anomalies in service response times or error codes during remote calls. Monitor firewall logs for new connections targeting gRPC ports. Investigate any sudden increase in traffic to service endpoints. Review authentication logs for missing credential checks.

What to do and how to stay safe: IBM

• Verify your IBM WebSphere Application Server - Liberty version to see if it falls within the affected range.
• Monitor network traffic for unauthorized access attempts to gRPC service methods.
• Restrict network access to gRPC endpoints to trusted IP addresses where possible.
• Wait for the vendor to provide an update or patch for CVE-2026-93895.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of IBM WebSphere Liberty are affected by CVE-2026-93895?

Versions 20.0.0.12 through 26.0.0.10 of IBM WebSphere Application Server - Liberty are affected.

What is the severity rating for this vulnerability?

The National Vulnerability Database rates CVE-2026-93895 as critical with a CVSS score of 9.1.

Can an attacker exploit this vulnerability remotely?

Yes, an unauthenticated remote attacker can bypass access controls configured on gRPC service methods.