IBM WebSphere Application Server: Authorization bypass enabling administrative impersonation
Summary
IBM WebSphere Application Server versions 8.5 and 9.0 contain an authorization bypass (CWE-287). An authenticated attacker with a low-privileged account can bypass authorization and impersonate administrators across the cell, which affects all managed nodes of the deployment. The CVSS vector is adjacent network, so exposure depends on whether the administrative interfaces are reachable from the attacker's network.
Affected
- IBM WebSphere Application Server traditional 8.5.0.0 through 8.5.5.31
- IBM WebSphere Application Server traditional 9.0.0.0 through 9.0.5.29
- Editions: Base, Network Deployment, Express, Developer and others as listed by IBM
Fixed in
- Interim fix resolving APAR DT501779 (after upgrading to the minimum fix pack level required by the interim fix), see https://www.ibm.com/support/pages/node/7292206
- Fix Pack 8.5.5.32 or later (targeted availability 4Q2026)
- Fix Pack 9.0.5.30 or later (targeted availability 4Q2026)
Workaround
- No vendor-published workaround: Unknown. IBM lists none on the bulletin.
- General measure (not vendor-confirmed): restrict administrative console and admin ports to management networks.
Exploitation
- No evidence of exploitation in the wild found.
- CISA KEV: not listed.
- No public exploit or proof of concept known.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS about 0.2%.
Our recommendation
- Check whether WebSphere 8.5 or 9.0 is in use, including products that embed it.
- Apply the interim fix for APAR DT501779 or the fix pack 8.5.5.32 / 9.0.5.30 when available.
- Restrict administrative console access to management networks and review accounts with administrative roles.
- Monitor administrative actions and cell-wide configuration changes for anomalies.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7292213 www.ibm.com
- NVD record via Vulners vulners.com
- PSIRT CVE details psirt.com
- HKCERT IBM WebSphere bulletin www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:26.
Original description (NVD)
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.