CVE-2026-105443: IBM WebSphere Liberty Privilege Escalation

CVE-2026-105443 is a privilege escalation vulnerability in IBM WebSphere Application Server - Liberty affecting versions 17.0.0.3 through 26.0.0.10, caused by insufficient isolation between servers sharing an install. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-105443 Overview

CVE-2026-105443 affects IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10. The flaw stems from insufficient isolation between servers that share a single Liberty installation. An authenticated attacker on one server can breach the trust boundary and compromise confidentiality and integrity of neighboring server instances. The weakness is classified under CWE-284: Improper Access Control.

Critical Impact
Attackers with low-privilege access to one Liberty server instance can access or modify data belonging to other servers running from the same shared installation, breaking tenant and workload isolation.

Affected Products

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10
Deployments where multiple Liberty servers share a single installation directory
Multi-tenant or multi-workload Liberty hosts

Discovery Timeline

2026-10-13 - CVE-2026-105443 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-105443

Vulnerability Analysis

IBM WebSphere Application Server Liberty supports running multiple server instances from a shared installation directory. These server instances are expected to operate as independent trust boundaries, each with its own configuration, applications, and runtime state. CVE-2026-105443 breaks this expectation. Shared resources within the installation do not enforce sufficient separation between co-located server processes.

The scope-changed CVSS vector indicates that an attacker who compromises or legitimately operates one Liberty server can impact resources outside that server's authorization boundary. The attack requires low privileges on a single server but no user interaction. High attack complexity suggests the attacker needs specific conditions, such as predictable file paths or timing, to pivot across the shared install.

Root Cause

The root cause is improper access control [CWE-284] on resources that are shared across co-located Liberty servers. When multiple servers are provisioned under one installation, components such as cached artifacts, temporary files, or runtime state are not partitioned with per-server authorization controls. A low-privileged actor on one server can read or modify artifacts that belong to another server.

Attack Vector

The attack vector is network based with low privileges required. An attacker first obtains access to one Liberty server, for example by authenticating as a tenant application or by exploiting a separate application-level flaw. From that foothold, the attacker leverages the shared installation to reach resources belonging to adjacent servers. The result is unauthorized disclosure and modification of data outside the attacker's assigned server scope.

No public proof-of-concept is available. See the IBM Support Article for vendor technical details.

Detection Methods for CVE-2026-105443

Indicators of Compromise

Unexpected read or write access to files under the shared Liberty install directory from a server process that does not own them.
Liberty server logs showing configuration or application artifacts being accessed by an unrelated server instance.
Anomalous process activity from a Liberty JVM touching paths associated with a different server name.

Detection Strategies

Audit file system access on the Liberty installation root and correlate access events with the originating server instance.
Review Liberty messages.log and ffdc output across all co-located servers for cross-server reference errors or permission anomalies.
Baseline the expected file access footprint of each Liberty server and alert on deviations.

Monitoring Recommendations

Enable OS-level auditing (auditd on Linux, Object Access auditing on Windows) for the Liberty install path.
Ship Liberty server logs and host audit logs to a centralized analytics platform for cross-server correlation.
Monitor for new or modified server definitions under the shared install that were not initiated through change management.

How to Mitigate CVE-2026-105443

Immediate Actions Required

Inventory all hosts running IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10.
Identify installations where more than one Liberty server shares the same install directory.
Apply the IBM fix referenced in the IBM Support Article as soon as it is available in your maintenance window.
Restrict shell and application-level access to Liberty hosts to reduce the attacker foothold required to exploit the flaw.

Patch Information

IBM has published remediation guidance in the IBM Support Article. Administrators should apply the fix pack or interim fix identified by IBM for Liberty versions in the affected range and verify the running version using productInfo version after upgrade.

Workarounds

Separate workloads by running each Liberty server from its own dedicated installation directory until the patch is applied.
Enforce strict file system permissions so that each Liberty server runs under a distinct OS user with access only to its own server directory.
Isolate tenants or sensitive workloads onto separate hosts or containers to eliminate the shared-install attack surface.

bash

# Verify installed Liberty version
${WLP_HOME}/bin/productInfo version

# Run each server as a dedicated user with scoped permissions
chown -R liberty_srv1:liberty_srv1 ${WLP_HOME}/usr/servers/server1
chmod -R 750 ${WLP_HOME}/usr/servers/server1