CVE-2026-95680: IBM WebSphere Application Server is affected by an authorization bypass
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
Other sources
IBM WebSphere Application Server could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server traditional 8.5to a version that resolves this vulnerability.Fixed in 8.5.5.32 - Upgrade
Upgrade
IBM WebSphere Application Server traditional 9.0to a version that resolves this vulnerability.Fixed in 9.0.5.30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch DT501779
Event History
Frequently Asked Questions
Which WebSphere Application Server versions are identified as affected?
IBM WebSphere Application Server 8.5 and 9.0 are identified as affected.
What level of access does an attacker need?
The attacker must already be authenticated and have low privileges. No user interaction is required.
How broadly could a successful compromise affect the environment?
Successful exploitation can lead to administrative impersonation across the WebSphere cell, rather than being limited to the attacker’s original privileges.