Auth Bypass on IBM WAS 9.0/8.5 Admin Servlet
CVE-2026-16185 Published on September 14, 2026

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:

ADJACENT_NETWORK

Attack Complexity:

HIGH

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

HIGH

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-16185 has been classified to as an AuthZ vulnerability or weakness.

Products Associated with CVE-2026-16185

Want to know whenever a new CVE is published for IBM WebSphere Application Server? stack.watch will email you.

IBM WebSphere Application Server

Affected Versions

IBM WebSphere Application Server:

Version 9.0 is affected.
Version 8.5 is affected.

Exploit Probability

EPSS

0.20%

Percentile

9.35%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.