IBM WebSphere Application Server: Authentication bypass in CSIv2 inbound handler
Summary
IBM WebSphere Application Server versions 8.5 and 9.0 contain a flaw in the CSIv2 inbound propagation handler. A remote attacker may be able to bypass authentication without valid credentials. The CVSS vector shows high attack complexity, so exploitation depends on specific conditions; the CVSS base score is 8.1 according to IBM, while VulDB rates it 7.3.
Affected
- IBM WebSphere Application Server 8.5
- IBM WebSphere Application Server 9.0
- Exact affected fix-level ranges: see IBM bulletin (not retrieved)
Fixed in
- Interim fix that resolves APAR DT502673 (IBM bulletin: https://www.ibm.com/support/pages/node/7292211), after upgrading to minimal fix pack levels required by the interim fix
- Fix Pack 9.0.5.30 or later (targeted availability 4Q2026), for 9.0.0.0 through 9.0.5.29
- Fix Pack 8.5.5.32 or later (targeted availability 4Q2026), for 8.5.0.0 through 8.5.5.31
- Note: the vendor page lists these fixes; the fix for 8.5 is taken from the bulletin text and should be verified
Workaround
Unknown. IBM's bulletin lists no workarounds or mitigations.
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in CISA KEV (per third-party aggregator).
- No public proof of concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether WebSphere Application Server 8.5 or 9.0 is in use, including legacy Java environments.
- Review the IBM security bulletin and apply the interim fix DT502673 or the fix pack that contains it as soon as possible.
- Restrict network access to WebSphere listener and CSIv2/IIOP ports to trusted hosts only.
- Review authentication logs for unexpected successful sessions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin CVE-2026-93907 www.ibm.com
- VulDB CVE-2026-93907 vuldb.com
- VulnerabilityDB NVD CVE-2026-93907 vulners.com
- Strix CVE-2026-93907 www.strix.ai
- HKCERT IBM WebSphere security bulletin www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:44.
Original description (NVD)
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.