What is the CVSS score of CVE-2026-10845?

CVE-2026-10845 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.4%.

Which versions of IBM WebSphere Application Server are affected by CVE-2026-10845?

IBM WebSphere Application Server versions 8.5 and 9.0 contain an authentication bypass enabling remote unauthorized access to business-critical web services without credentials.. A patch is available.

How to fix or mitigate CVE-2026-10845?

Within 24 hours: Identify and inventory all systems running IBM WebSphere Application Server 8.5 or 9.0, particularly those exposed to networks or hosting mission-critical JAX-WS services. Within 7 days: Apply vendor patch via IBM support advisory 7276597 to all affected production systems. Within 30 days: Verify patch installation across all systems and conduct authentication testing to confirm web services properly enforce credentials.

IBM WebSphere Application Server CVE-2026-10845

EUVD-2026-38288 HIGH

Improper Authentication (CWE-287)

2026-06-22 ibm

GHSA-8fp2-p896-ch7x

Authentication Bypass IBM Websphere Application Server

7.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Remote, no-auth bypass of JAX-WS authentication (AV:N/AC:L/PR:N/UI:N); impacts limited to what the affected JAX-WS apps expose, not full WAS compromise, so C/I/A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 18:23 vuln.today

CVSS changed

Jun 22, 2026 - 18:23 NVD

7.3 (HIGH)

CVE Published

Jun 22, 2026 - 14:43 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.

AnalysisAI

Authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows remote attackers to gain unauthorized access to JAX-WS web service applications without valid credentials. The CVSS 7.3 score reflects network-reachable, no-authentication exploitation with partial confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but a vendor patch is available via IBM support advisory 7276597.

Technical ContextAI

WebSphere Application Server (WAS) is IBM's Java EE/Jakarta EE runtime widely deployed for enterprise web services. JAX-WS (Java API for XML-Web Services, JSR-224) is the SOAP-based web services stack embedded in WAS used to expose and consume XML web services. The flaw is classified as CWE-287 (Improper Authentication), meaning the JAX-WS engine's authentication enforcement path can be bypassed - typically through malformed SOAP/WS-Security headers, incorrect policy binding evaluation, or an authentication decision that fails open. The CPE cpe:2.3:a:ibm:websphere_application_server:*:*:* covers all unpatched 8.5.x and 9.0.x deployments running JAX-WS endpoints.

RemediationAI

Patch available per vendor advisory: apply the IBM-provided interim fix or fix pack referenced at https://www.ibm.com/support/pages/node/7276597 for both the 8.5.x and 9.0.x branches (EUVD references Interim Fix 035 on the 8.5 stream and Interim Fix 017 on the 9.0 stream - confirm the exact IFix identifier for your installed maintenance level with IBM Support before deploying). If patching cannot be done immediately, compensating controls include restricting network reachability of JAX-WS endpoints to trusted clients via firewall or reverse-proxy ACLs, enforcing WS-Security with mutual TLS or message-level signatures at the proxy tier (trade-off: requires SOAP-aware infrastructure and may break existing clients), and disabling or undeploying any non-essential JAX-WS applications until the fix is in place (trade-off: service outage for those endpoints). Review WAS authentication logs for anomalous successful JAX-WS calls lacking expected credentials.