What is the CVSS score of CVE-2026-16184?

CVE-2026-16184 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere Application Server are affected by CVE-2026-16184?

IBM WebSphere Application Server 9.0 and 8.5 contain a critical authentication bypass vulnerability allowing remote attackers to access protected business systems without valid credentials.

How to fix or mitigate CVE-2026-16184?

Within 24 hours, conduct a comprehensive inventory of all IBM WebSphere Application Server instances, specifically identifying any running versions 8.5 or 9.0 and documenting network exposure and hosted applications. Within 7 days, implement compensating controls including network segmentation to isolate affected systems, Web Application Firewall (WAF) rules to enforce authentication validation, enhanced monitoring and alerting for unauthorized access attempts, and firewall policies restricting access to WebSphere management and application endpoints. Within 30 days, develop a remediation roadmap including either upgrading to patched versions when IBM releases them, migrating to alternative application server platforms, or maintaining strict network isolation of affected systems.

IBM WebSphere Application Server CVE-2026-16184

EUVD-2026-50016 CRITICAL

Missing Authorization (CWE-862)

2026-07-28 psirt@us.ibm.com

GHSA-78h9-3p2w-5gmr

Authentication Bypass IBM Websphere Application Server

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (us) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote crafted request needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); an auth bypass to protected resources plausibly yields high C/I/A, though SSVC 'partial' impact leaves some doubt.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (us).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 03, 2026 - 15:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 03, 2026 - 15:07 vuln.today

cvss_changed

Severity Changed

Aug 03, 2026 - 15:07 NVD

HIGH CRITICAL

CVSS changed

Aug 03, 2026 - 15:07 NVD

7.0 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 28, 2026 - 20:31 vuln.today

CVE Published

Jul 28, 2026 - 20:17 nvd

HIGH 7.0

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

AnalysisAI

Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a specially crafted request and reach protected resources without valid credentials, with CVSS rating full compromise of confidentiality, integrity, and availability. The flaw stems from missing authorization enforcement (CWE-862) and carries a CVSS 9.8 requiring no user interaction or privileges. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach exposed WebSphere endpoint over network

Delivery

Send crafted unauthenticated request

Exploit

Bypass authorization check (CWE-862)

Execution

Access protected functionality or data

Impact

Compromise confidentiality, integrity, availability

Access

Reach exposed WebSphere endpoint over network

Delivery

Send crafted unauthenticated request

Exploit

Bypass authorization check (CWE-862)

Execution

Access protected functionality or data

Impact

Compromise confidentiality, integrity, availability

Vulnerability AssessmentAI

Exploitation	Exploitation requires only network reachability to an affected IBM WebSphere Application Server 9.0 or 8.5 instance and the ability to send a crafted unauthenticated request to the vulnerable endpoint; no credentials, no user interaction, and no elevated privileges are needed (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are mixed and warrant careful triage. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with only network reachability to the WebSphere server sends a single crafted HTTP request that omits or manipulates the expected authentication step, and the server processes it as authorized, granting access to protected functionality or data without credentials. No public exploit is identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N profile means exploitation is a straightforward one-shot remote request once details are known.
Remediation	Patch available per vendor advisory: apply the interim fix (iFix) or fix pack IBM specifies for your affected 9.0 or 8.5 release as documented at https://www.ibm.com/support/pages/node/7281628 - take the exact patched build directly from that page, as no specific fix version is provided in the source data. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct a comprehensive inventory of all IBM WebSphere Application Server instances, specifically identifying any running versions 8.5 or 9.0 and documenting network exposure and hosted applications. …

Threat intelligence, references, and detailed analysis are available after sign-in.