CVE-2026-93895 is a critical (CVSS 9.1) flaw in IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10. An unauthenticated remote attacker can use it to get around the access controls set on gRPC service methods.
What Is It
IBM's PSIRT disclosed the vulnerability, and NVD published it on October 13, 2026. According to the description, affected versions of WebSphere Application Server - Liberty "could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods."
The weakness is classified as CWE-284 (Improper Access Control). NVD currently lists the record as "Received," so its analysis has not been completed.
Why It Matters
IBM rates the flaw 9.1 (CRITICAL) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. That vector means:
- Network-reachable: the attack can be launched remotely.
- Low complexity: no special conditions are needed.
- No privileges or user interaction required: the attacker doesn't need credentials or anyone's help.
- High confidentiality and integrity impact: the attacker may be able to read and change data that the gRPC method access controls are meant to protect.
- No availability impact is scored.
Because the attacker doesn't need to log in and the attack is simple, any exposed Liberty server that relies on access controls at the gRPC method level should be treated as high priority.
As of this writing, CISA's Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE. The supplied sources do not confirm active exploitation.
What's Vulnerable
- Vendor: IBM
- Product: WebSphere Application Server - Liberty
- Affected versions: 20.0.0.12 through 26.0.0.10, inclusive
The risk applies to deployments that expose gRPC services and use access controls configured on gRPC service methods.
Patch Status
The supplied NVD record does not name a fixed version or give specific remediation steps. Because the issue isn't in the KEV catalog, there is no CISA-mandated required action or due date. For fix and mitigation guidance, administrators should check IBM's security bulletin (linked below). Until a fix is applied, they should review whether affected Liberty instances expose gRPC endpoints to untrusted networks.