CVE-2026-10845 - Vulnerability Details - OpenCVE

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Ibm	Websphere Application Server

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7276597

History

Mon, 22 Jun 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 22 Jun 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.
Title		IBM WebSphere Application Server is affected by an authentication bypass vulnerability
First Time appeared		Ibm Ibm websphere Application Server
Weaknesses		CWE-287
CPEs		cpe:2.3:a:ibm:websphere_application_server:8.5.0:::::::* cpe:2.3:a:ibm:websphere_application_server:8.5:::::::* cpe:2.3:a:ibm:websphere_application_server:9.0.0:::::::* cpe:2.3:a:ibm:websphere_application_server:9.0:::::::*
Vendors & Products		Ibm Ibm websphere Application Server
References		https://www.ibm.com/support/pages/node/7276597

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2026-06-22T14:43:16.611Z

Updated: 2026-06-22T16:06:02.894Z

Reserved: 2026-06-04T12:02:38.679Z

Link: CVE-2026-10845

Vulnrichment

Updated: 2026-06-22T16:05:53.970Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10845", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-06-04T12:02:38.679Z", "datePublished": "2026-06-22T14:43:16.611Z", "dateUpdated": "2026-06-22T16:06:02.894Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-06-22T14:43:16.611Z"}, "title": "IBM WebSphere Application Server is affected by an authentication bypass vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "WebSphere Application Server", "versions": [{"status": "affected", "version": "8.5.0", "lessThanOrEqual": "7.0.2 Interim Fix 035", "versionType": "semver"}, {"status": "affected", "version": "9.0.0", "lessThanOrEqual": "7.0.3 Interim Fix 017", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Application Server 8.5 and 9.0\u00a0could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM WebSphere Application Server 8.5 and 9.0 <span>could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.</span></p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7276597", "tags": ["vendor-advisory", "patch"]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71648.\n\n\n\nFor IBM WebSphere Application Server traditional:\n\n\n\nFor V9.0.0.0 through 9.0.5.28:\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71648 https://www.ibm.com/support/pages/node/7276411 \n--OR--\n\u00b7 Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).\u00a0\n\n\n\nFor V8.5.0.0 through 8.5.5.29:\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71648 https://www.ibm.com/support/pages/node/7276411 \n--OR--\n\u00b7 Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).\u00a0\n\n\n\n\n\n\n\nAdditional interim fixes may be available and linked off the interim fix download page.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71648.</p><p><strong>For IBM WebSphere Application Server traditional:</strong></p><p><strong>For V9.0.0.0 through 9.0.5.28:</strong><br>\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves <a href=\"https://www.ibm.com/support/pages/node/7276411\" rel=\"nofollow\">PH71648</a><br>--OR--<br>\u00b7 Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026). </p><p><strong>For V8.5.0.0 through 8.5.5.29:</strong><br>\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves <a href=\"https://www.ibm.com/support/pages/node/7276411\" rel=\"nofollow\">PH71648</a><br>--OR--<br>\u00b7 Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026). </p><p></p><p>Additional interim fixes may be available and linked off the interim fix download page.</p>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T16:05:58.974560Z", "id": "CVE-2026-10845", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T16:06:02.894Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-10845", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T16:05:58.974560Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T16:05:53.970Z"}}], "cna": {"title": "IBM WebSphere Application Server is affected by an authentication bypass vulnerability", "affected": [{"cpes": ["cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "WebSphere Application Server", "versions": [{"status": "affected", "version": "8.5.0", "versionType": "semver", "lessThanOrEqual": "7.0.2 Interim Fix 035"}, {"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.3 Interim Fix 017"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71648.\n\n\n\nFor IBM WebSphere Application Server traditional:\n\n\n\nFor V9.0.0.0 through 9.0.5.28:\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71648 https://www.ibm.com/support/pages/node/7276411 \n--OR--\n\u00b7 Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).\u00a0\n\n\n\nFor V8.5.0.0 through 8.5.5.29:\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71648 https://www.ibm.com/support/pages/node/7276411 \n--OR--\n\u00b7 Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).\u00a0\n\n\n\n\n\n\n\nAdditional interim fixes may be available and linked off the interim fix download page.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71648.</p><p><strong>For IBM WebSphere Application Server traditional:</strong></p><p><strong>For V9.0.0.0 through 9.0.5.28:</strong><br>\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves <a href=\"https://www.ibm.com/support/pages/node/7276411\" rel=\"nofollow\">PH71648</a><br>--OR--<br>\u00b7 Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026). </p><p><strong>For V8.5.0.0 through 8.5.5.29:</strong><br>\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves <a href=\"https://www.ibm.com/support/pages/node/7276411\" rel=\"nofollow\">PH71648</a><br>--OR--<br>\u00b7 Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026). </p><p></p><p>Additional interim fixes may be available and linked off the interim fix download page.</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7276597", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM WebSphere Application Server 8.5 and 9.0\u00a0could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM WebSphere Application Server 8.5 and 9.0 <span>could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-06-22T14:43:16.611Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10845", "state": "PUBLISHED", "dateUpdated": "2026-06-22T16:06:02.894Z", "dateReserved": "2026-06-04T12:02:38.679Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-06-22T14:43:16.611Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}