Identity Spoofing Vulnerability in IBM WebSphere Application Server
CVE-2026-8644

9.1CRITICAL

Key Information:

Vendor

IBM
Status
Websphere Application Server
Vendor
CVE Published:
1 June 2026

What is CVE-2026-8644?

IBM WebSphere Application Server versions 9.0 and 8.5 are susceptible to an identity spoofing vulnerability that could allow an attacker to impersonate legitimate users. This issue may lead to unauthorized access to sensitive data or functions within the application. Users and administrators are encouraged to apply the latest patches to mitigate this risk and protect their systems.

Affected Version(s)

WebSphere Application Server 9.0 <= 1.1.9.12

WebSphere Application Server 8.5

References

https://www.ibm.com/support/pages/node/7274740
vendor-advisorypatch

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.