WebSphere Application Server CVE-2026-16185

Exploitation requires the attacker to be positioned on an adjacent network with routing or L2 reachability to the WebSphere administrative console servlet endpoint - this is an AV:A flaw, so internet-only attackers without a foothold on the management segment cannot reach it. The administrative console must be running and reachable on the network rather than bound exclusively to localhost, and the targeted servlet must be deployed and enabled in that console; default WebSphere installations do run the console, but many hardened enterprises disable, unbind, or firewall it, which removes the precondition entirely. No authentication is required (PR:N) and no user interaction is required (UI:N), but attack complexity is HIGH, implying the bypass depends on a specific request sequence, timing window, or server state rather than succeeding with an arbitrary single request - an attacker may need repeated attempts or knowledge of the servlet's expected parameters. What limits real-world exploitation: the adjacency requirement, the elevated complexity, the absence of public exploit code, the lack of any KEV or SSVC exploitation signal, and the availability of a vendor patch. The vector does not indicate a scope change, so impact is confined to the vulnerable WebSphere instance.

The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H, base 6.4) is the most informative signal here and is deliberately ambivalent: the attack vector is ADJACENT rather than NETWORK, meaning the attacker must already sit on a network segment with reachability to the console - this is not an internet-exposed, drive-by flaw. Attack complexity is HIGH and privileges required are NONE with no user interaction, which is consistent with an authentication bypass that requires specific timing, request shaping, or a particular server state to succeed rather than a simple one-shot request. The impact triad (low confidentiality, low integrity, high availability) is unusual for a pure auth bypass and suggests the bypassed servlet can be driven to consume resources or disrupt service availability. CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) reinforces a 'no urgent action, patch on cycle' posture rather than an emergency. Caveats: no EPSS score was supplied, and no POC or exploitation reporting is present in the inputs, so exploitation probability cannot be independently quantified - treat the absence of KEV as 'no confirmed active exploitation,' not as proof the flaw is unexploitable. Note the tension between the description's 'remote attacker' phrasing and the AV:A metric; the CVSS vector should control the assessment unless IBM's advisory states otherwise.

An attacker who has established a foothold on an adjacent network segment - a compromised host in the same VLAN, a co-tenant system, or a poorly segmented management network - sends crafted requests directly to the WebSphere administrative console servlet, exploiting the missing authorization check to act without valid credentials. Because complexity is high, the attacker likely needs to iterate on request structure or server state before the bypass succeeds, but no user interaction or prior authentication is required. Once through, the attacker can read limited console data, make limited unauthorized changes, and degrade or disrupt the server, affecting its availability.