What is the CVSS score of CVE-2026-10842?

CVE-2026-10842 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere are affected by CVE-2026-10842?

IBM WebSphere Application Server (versions 8.5, 9.0 Traditional, and Liberty 17.0.0.3-26.0.0.7) contains a security constraint bypass vulnerability that enables unauthenticated remote attackers to…. A patch is available.

How to fix or mitigate CVE-2026-10842?

Within 24 hours, conduct an inventory of all WebSphere deployments and identify systems running affected versions (8.5, 9.0 Traditional, or Liberty 17.0.0.3 through 26.0.0.7). Within 7 days, deploy vendor patches to development and testing environments to validate compatibility before production rollout. Within 30 days, apply patches to all production WebSphere instances and verify access controls are functioning correctly post-patching.

IBM WebSphere CVE-2026-10842

EUVD-2026-51184 HIGH

Authentication Bypass by Alternate Name (CWE-289)

2026-07-30 ibm

GHSA-xhv7-44rm-j43c

Authentication Bypass IBM Websphere Application Server Websphere Application Server Liberty

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable, low-complexity, unauthenticated constraint bypass with no user interaction; impact is confidentiality-only data disclosure, so I and A are None.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:51 vuln.today

CVE Published

Jul 30, 2026 - 15:57 nvd

HIGH 7.5

DescriptionCVE.org

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.

AnalysisAI

Security constraint bypass in IBM WebSphere Application Server 8.5/9.0 (Traditional) and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 allows a remote, unauthenticated attacker to circumvent access controls and reach protected resources, resulting in disclosure of confidential information (CVSS 3.1 base 7.5, C:H). The flaw stems from an authentication-bypass-by-alternate-name weakness (CWE-289) in how the server evaluates security constraints. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

WebSphere Application Server is IBM's Java EE/Jakarta EE application server, shipped in two lineages: the older 'Traditional' profile (8.5, 9.0) and the modern lightweight 'Liberty' profile (versioned by year, 17.0.0.3 through 26.0.0.7). Security constraints in these servers are declarative rules (web.xml <security-constraint> elements or server configuration) that map URL patterns and HTTP methods to authorization requirements. The root cause is classified as CWE-289 (Authentication Bypass by Alternate Name), meaning the server can be reached through an alternate path, casing, method, or encoding representation of a protected resource that is not matched by the constraint logic - allowing the request to slip past the intended authorization gate. The affected CPEs are cpe:2.3:a:ibm:websphere_application_server and cpe:2.3:a:ibm:websphere_application_server_-_liberty, confirming both the Traditional and Liberty distributions are in scope.

RemediationAI

Apply the vendor fix: a patch is available per IBM's security bulletin at https://www.ibm.com/support/pages/node/7280131 - apply the corresponding interim fix (iFix/APAR) for WebSphere Application Server Traditional 8.5 and 9.0, and upgrade Liberty to the patched fixpack above the 26.0.0.7 affected range as directed in that bulletin (exact fix version not stated in the provided input, so confirm the target level from the advisory). Until patching is possible, compensating controls include placing the affected server behind a reverse proxy or WAF that normalizes and canonicalizes request URIs (collapsing alternate encodings, casing, and path variants) and enforces authorization at the proxy for the sensitive URL patterns - with the trade-off of added latency and the risk of proxy rules not perfectly mirroring the application's own constraints - and restricting network exposure of protected endpoints to trusted networks, which limits attacker reach but does not close the underlying bypass.