IBM WebSphere Application Server is affected by an authentication bypass vulnerability

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-10845",
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "dateUpdated": "2026-06-22T16:06:02.894Z",
    "dateReserved": "2026-06-04T12:02:38.679Z",
    "datePublished": "2026-06-22T14:43:16.611Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm",
        "dateUpdated": "2026-06-22T14:43:16.611Z"
      },
      "title": "IBM WebSphere Application Server is affected by an authentication bypass vulnerability",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.",
          "supportingMedia": [
            {
              "type": "text/html",
              "base64": false,
              "value": "<p>IBM WebSphere Application Server 8.5 and 9.0&nbsp;<span>could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.</span></p>"
            }
          ]
        }
      ],
      "affected": [
        {
          "vendor": "IBM",
          "product": "WebSphere Application Server",
          "cpes": [
            "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "8.5.0",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.2 Interim Fix 035"
            },
            {
              "version": "9.0.0",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.3 Interim Fix 017"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-287 Improper Authentication",
              "cweId": "CWE-287",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://www.ibm.com/support/pages/node/7276597",
          "tags": [
            "vendor-advisory",
            "patch"
          ]
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71648.\n\n\n\nFor IBM WebSphere Application Server traditional:\n\n\n\nFor V9.0.0.0 through 9.0.5.28:\n· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves  PH71648 https://www.ibm.com/support/pages/node/7276411 \n--OR--\n· Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026). \n\n\n\nFor V8.5.0.0 through 8.5.5.29:\n· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves  PH71648 https://www.ibm.com/support/pages/node/7276411 \n--OR--\n· Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026). \n\n\n\n\n\n\n\nAdditional interim fixes may be available and linked off the interim fix download page.",
          "supportingMedia": [
            {
              "type": "text/html",
              "base64": false,
              "value": "<p>IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71648.</p><p><strong>For IBM WebSphere Application Server traditional:</strong></p><p><strong>For V9.0.0.0 through 9.0.5.28:</strong><br>· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves <a href=\"https://www.ibm.com/support/pages/node/7276411\" rel=\"nofollow\">PH71648</a><br>--OR--<br>· Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).&nbsp;</p><p><strong>For V8.5.0.0 through 8.5.5.29:</strong><br>· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves <a href=\"https://www.ibm.com/support/pages/node/7276411\" rel=\"nofollow\">PH71648</a><br>--OR--<br>· Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).&nbsp;</p><p></p><p>Additional interim fixes may be available and linked off the interim fix download page.</p>"
            }
          ]
        }
      ]
    },
    "adp": [
      {
        "providerMetadata": {
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP",
          "dateUpdated": "2026-06-22T16:06:02.894Z"
        },
        "title": "CISA ADP Vulnrichment",
        "metrics": [
          {
            "cvssV3_1": {
              "version": "3.1",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "attackVector": "NETWORK",
              "attackComplexity": "LOW",
              "privilegesRequired": "NONE",
              "userInteraction": "NONE",
              "scope": "UNCHANGED",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH"
            }
          },
          {}
        ]
      }
    ]
  }
}