Authorization Bypass in IBM WebSphere Application Server Products
CVE-2026-16190

3.1LOW

Key Information:

Vendor

IBM
Status
Websphere Application Server
Vendor
CVE Published:
14 September 2026

What is CVE-2026-16190?

IBM WebSphere Application Server versions 9.0 and 8.5 are susceptible to an authorization bypass vulnerability. This flaw allows an attacker to gain access to sensitive resources and functionalities that they should not have permissions for. It is crucial for organizations using these versions to apply the necessary patches to mitigate potential security risks and enhance their application server’s integrity.

Affected Version(s)

WebSphere Application Server 9.0

WebSphere Application Server 8.5

References

https://www.ibm.com/support/pages/node/7286610
vendor-advisorypatch

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.