IBM week 42 2026: WebSphere and Db2 access-control flaws headline 30 CVEs

The release at a glance

IBM published 30 CVEs for the week of 12–18 October 2026. The release spans WebSphere Application Server - Liberty (13 CVEs), Db2 (7), DB2 Recovery Expert for Linux, UNIX and Windows (4), WebSphere Application Server (3), Db2 Genius Hub (2) and Db2 Mirror for i (1). Severity breakdown: 3 critical, 11 high, 14 medium and 2 low. None of the CVEs appears in CISA's Known Exploited Vulnerabilities catalogue.

The issues that stand out are network-reachable access-control and authentication-bypass flaws in WebSphere Liberty and WebSphere Application Server, plus privilege-escalation flaws in Db2 and Db2 Mirror for i. IBM has published advisories for the affected products.

What matters most

Db2 Mirror for i — CVE-2026-96012 (CVSS 9.9) is the highest-scoring issue this week. An authenticated attacker can craft a request that bypasses additional authorisation and input validation, leading to code execution and elevated privileges on 7.4, 7.5 and 7.6. This CVE has its own advisory page on this site.

WebSphere Application Server - Liberty — CVE-2026-93895 (CVSS 9.1) allows an unauthenticated remote attacker to bypass access controls on gRPC service methods in releases 20.0.0.12 through 26.0.0.10. CVE-2026-93909 (CVSS 9.1) is an authentication bypass when the samlWeb-2.0 feature is enabled, affecting 17.0.0.3 through 26.0.0.10; it is automatable and has a separate advisory page. CVE-2026-101294 (CVSS 8.7) allows remote bypass of cryptographic signature verification in both Liberty and WebSphere Application Server. CVE-2026-105443 (CVSS 8.2) is an isolation weakness between servers sharing an install, and CVE-2026-93905 (CVSS 8.2) lets an unauthenticated attacker corrupt the persisted status of batch job instances.

WebSphere Application Server — CVE-2026-93907 (CVSS 8.1) is a remote authentication bypass in the CSIv2 inbound propagation handler in 8.5 and 9.0. CVE-2026-95680 (CVSS 8.0) allows an authenticated attacker to bypass authorisation and impersonate administrators across the cell.

Db2 — CVE-2026-105465 and CVE-2026-105464 (both CVSS 8.8) are local privilege-escalation issues affecting 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5; one involves enabling db2locssh, and the other arises from improper privilege management for DBADM users. CVE-2026-18166 (CVSS 7.7) allows a privileged database user to read sensitive host files through the CREATE WRAPPER command over the network.

Patch in this order

1. Patch internet-facing WebSphere Liberty first. Address CVE-2026-93895 and CVE-2026-93909 on any system where gRPC services or samlWeb-2.0 is enabled; both are unauthenticated, network-reachable, critical flaws.
2. Patch WebSphere Application Server 8.5 and 9.0 for CVE-2026-93907 and CVE-2026-95680, particularly any deployment using CSIv2 inbound propagation or cell administration.
3. Patch Db2 Mirror for i 7.4, 7.5 and 7.6 for CVE-2026-96012. Although it requires an authenticated user, it has a 9.9 score and can lead to code execution and privilege escalation.
4. Patch Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for CVE-2026-105465, CVE-2026-105464 and CVE-2026-18166. These require a local or authenticated user but allow privilege escalation or sensitive file access.
5. Review and apply the remaining IBM advisories for WebSphere Liberty and WebSphere Application Server, including CVE-2026-101294, CVE-2026-105443, CVE-2026-93905 and CVE-2026-105442, according to your deployment.
6. Review the DB2 Recovery Expert for Linux, UNIX and Windows and Db2 Genius Hub advisories after the internet-facing and high-severity items; these are medium or low severity.

IBM's advisories state that fixes are available for the most important CVEs; the records do not list specific fixed version numbers, so use the vendor advisory for your product line.

Beyond the patch

Next month, the same decision will recur: which IBM components are reachable without credentials, and what has actually been exploited. Virtual CISO Services (vCISO) helps keep an up-to-date map of external exposure so that network-reachable issues such as the WebSphere Liberty access-control flaws are patched first. Because several of these flaws involve privilege escalation or code execution, Managed Detection & Response (MDR) provides monitoring for the account and endpoint activity that follows an exploit attempt while patching is being scheduled.