IBM i PTF Guide, Volume 28, Number 13

March 30, 2026 Doug Bidwell

Welcome to Monday and a whole new batch of security vulnerabilities with the IBM i platform, all thanks to the open source variant of the venerable Apache Web server embedded in the WebSphere Application Server Liberty edition.

That’s the good thing about open source software: When there are problems, people find them and they fix them. The bad thing is that a lot of really smart people are constantly looking at the code for issues, and they are always find them. Think of it as Continuous Vulnerability/Continuous Patching, I guess.

Let’s go through them, and all of the vulnerabilities affect IBM WebSphere Application Server – Liberty 17.0.0.3 through 26.0.0.3.

First, we have Security Bulletin: IBM WebSphere Application Server Liberty is affected by a privilege escalation vulnerability (CVE-2025-14915), with more information available here.

Second, we have Security Bulletin: IBM WebSphere Application Server Liberty is affected by server-side request forgery (CVE-2026-1561), with more information at this link.

Third, we have Security Bulletin: IBM WebSphere Application Server Liberty is affected by a prototype pollution vulnerability due to immutable (CVE-2026-29063), and you can find out more about this issue here.

And finally, we have Security Bulletin: IBM WebSphere Application Server Liberty could provide weaker than expected security (CVE-2025-14917), with more information at this link.

Here is the rundown of PTF Groups by IBM i release level since we last published:

PTF Groups 7.6:

Fix list for IBM WebSphere Application Server Liberty
WebSphere Application Server traditional Version
Defective PTFs
Visual Studio Code for IBM i

PTF Groups 7.5:

Fix list for IBM WebSphere Application Server Liberty
WebSphere Application Server traditional Version
Defective PTFs
Visual Studio Code for IBM i

PTF Groups 7.4:

Fix list for IBM WebSphere Application Server Liberty
WebSphere Application Server traditional Version
Defective PTFs
Visual Studio Code for IBM i

PTF Groups 7.3:

Fix list for IBM WebSphere Application Server Liberty
WebSphere Application Server traditional Version
Visual Studio Code for IBM i

PTF Groups 7.2:

None

Tip O’ The Week: Buy low, sell high. . . .

New (or Updated) links added to the ‘Links’ tab in The Guide this week:

None

New (or Updated) links added to the ‘QMGtools’ tab in The Guide this week:

None

New (or Updated) links added to the ‘ACS_NAV’ tab in The Guide this week:

None

New (or Updated) links added to the ‘Prtr Links’ tab in The Guide this week:

None

New (or Updated) links Redbooks added this week:

None

New (or Updated) stuff added to REF tab in The Guide this week:

None

New (or Updated) links in the TAPE tab in The Guide this week:

None

New (or Updated) links in the WAS tab in The Guide this week:

None

The Guide at a glance: There were new defectives the week of 03/28/26. Defective PTF rundown – the latest defective for each release. Click on the Defective PTF link for your release in the Guide:

	Defect	   Defective	APAR		Fixing
	Date	   PTF				PTF
	--------   --------	---------	-----------------------	
7.6	03/17/26   SJ07685	DT465567	SJ09038 (When available)(read the recommendations)
							Read the cover letter-prerequisites!			
7.5	03/17/26   SJ07685	DT465567	SJ09038 (When available)(read the recommendations)
				 			Read the cover letter-prerequisites!                   	
7.4	03/17/26   SJ05258	DT465567	SJ09037	Same as above, Please read the Cover letter - 
							(When available)(read the recommendations)
							Read the cover letter-prerequisites!
7.3	01/27/25   SJ03169	DT422375	SJ03786 (When available)(read the recommendations)

Be sure to access the link in The Guide for further details.

Below is the usual archive of the IBM i PTF Guide to help you work through the PTFs in chronological order:

March 28, 2026: Volume 28, Number 13

March 23, 2026: Volume 28, Number 12

March 14, 2026: Volume 28, Number 11

March 7, 2026: Volume 28, Number 10

February 28, 2026: Volume 28, Number 09

February 21, 2026: Volume 28, Number 08

February 14, 2026: Volume 28, Number 07

February 7, 2026: Volume 28, Number 06

January 31, 2026: Volume 28, Number 05

January 24, 2026: Volume 28, Number 04