CVE-2026-93895

CVE-2026-93895 allows unauthenticated remote attackers to bypass access controls on gRPC service methods in IBM WebSphere Application Server - Liberty.

This vulnerability enables an unauthenticated remote attacker to bypass configured access controls on gRPC service methods, potentially leading to unauthorized data access or system compromise. DIB organizations must ensure their WebSphere deployments are patched to prevent unauthorized access and maintain compliance with access control requirements under NIST 800-171.

Shame score — A critical CVSS 9.1 vulnerability allowing unauthenticated remote access control bypass is highly avoidable through timely patching and represents a significant compliance and security risk.