What is the CVSS score of CVE-2026-16184?

CVE-2026-16184 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere Application Server are affected by CVE-2026-16184?

IBM WebSphere Application Server 9.0 and 8.5 contain a critical authentication bypass vulnerability allowing remote attackers to access protected business systems without valid credentials.

How to fix or mitigate CVE-2026-16184?

Within 24 hours, conduct a comprehensive inventory of all IBM WebSphere Application Server instances, specifically identifying any running versions 8.5 or 9.0 and documenting network exposure and hosted applications. Within 7 days, implement compensating controls including network segmentation to isolate affected systems, Web Application Firewall (WAF) rules to enforce authentication validation, enhanced monitoring and alerting for unauthorized access attempts, and firewall policies restricting access to WebSphere management and application endpoints. Within 30 days, develop a remediation roadmap including either upgrading to patched versions when IBM releases them, migrating to alternative application server platforms, or maintaining strict network isolation of affected systems.

IBM WebSphere Application Server CVE-2026-16184

EUVD-2026-50016 CRITICAL

Missing Authorization (CWE-862)

2026-07-28 psirt@us.ibm.com

GHSA-78h9-3p2w-5gmr

Authentication Bypass IBM Websphere Application Server

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (us) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote crafted request needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); an auth bypass to protected resources plausibly yields high C/I/A, though SSVC 'partial' impact leaves some doubt.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (us).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 03, 2026 - 15:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 03, 2026 - 15:07 vuln.today

cvss_changed

Severity Changed

Aug 03, 2026 - 15:07 NVD

HIGH CRITICAL

CVSS changed

Aug 03, 2026 - 15:07 NVD

7.0 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 28, 2026 - 20:31 vuln.today

CVE Published

Jul 28, 2026 - 20:17 nvd

HIGH 7.0

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

AnalysisAI

Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a specially crafted request and reach protected resources without valid credentials, with CVSS rating full compromise of confidentiality, integrity, and availability. The flaw stems from missing authorization enforcement (CWE-862) and carries a CVSS 9.8 requiring no user interaction or privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.31% (24th percentile) and CISA SSVC currently rates exploitation as 'none' with only partial technical impact.

Technical ContextAI

IBM WebSphere Application Server (WAS) is a Java EE/Jakarta EE enterprise application server used to host mission-critical web applications, web services, and middleware integrations in large enterprises. The affected releases are the long-supported 9.0 and traditional 8.5 (V8.5.5) trains, identified in NVD CPE data as cpe:2.3:a:ibm:websphere_application_server. The root cause maps to CWE-862 (Missing Authorization): a request path exists where the server fails to enforce an authorization check that should gate access, so a crafted unauthenticated request reaches functionality that should require valid credentials. This class of flaw typically arises from a specific servlet, admin interface, or SOAP/REST endpoint whose security constraint check is omitted or mishandled.

RemediationAI

Patch available per vendor advisory: apply the interim fix (iFix) or fix pack IBM specifies for your affected 9.0 or 8.5 release as documented at https://www.ibm.com/support/pages/node/7281628 - take the exact patched build directly from that page, as no specific fix version is provided in the source data. Because this is a network-reachable unauthenticated bypass, if patching cannot be immediate, apply compensating controls: restrict network access to the WebSphere HTTP/HTTPS and administrative (SOAP/IPC, admin console) ports to trusted management networks via firewall/segmentation; place affected endpoints behind a reverse proxy or WAF that enforces authentication on the vulnerable path; and disable or firewall off non-essential remote administrative or web-service endpoints. Trade-offs: IP allowlisting and proxy-enforced auth may break legitimate remote integrations and monitoring, and a WAF rule is only as reliable as the (non-public) crafted-request pattern - treat these as stopgaps until the IBM fix is applied.