CVE-2026-93907: IBM WebSphere Application Server is affected by a bypass authentication vulnerability
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
Other sources
IBM WebSphere Application Server could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server traditionalto a version that resolves this vulnerability.Fixed in 8.5.5.32 - Upgrade
Upgrade
IBM WebSphere Application Server traditionalto a version that resolves this vulnerability.Fixed in 9.0.5.30 - Upgrade
Upgrade
IBM WebSphere Application Server traditionalto a version that resolves this vulnerability.Patch DT502673
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
IBM WebSphere Application Server versions 8.5 and 9.0 are identified as affected. The vulnerability is remotely exploitable and does not require prior authentication or user interaction.
What must an attacker do to exploit it?
An attacker must exploit the flaw in the CSIv2 inbound propagation handler. The attack complexity is rated high, indicating exploitation requires conditions beyond simply sending a basic unauthenticated request.
What is the potential impact of a successful attack?
Successful exploitation can bypass authentication and is rated as having high impact to confidentiality, integrity, and availability.