IBM WebSphere Application Server CVE-2026-16186

Exploitation requires that a victim user with an active browser session to the WebSphere application follow a specially crafted URL delivered by the attacker - user interaction (UI:R) is mandatory and is the primary limiting factor. The CVSS PR:N metric confirms the attacker requires no credentials on the target WebSphere server. There is no indication in the available data of a non-default configuration trigger; the vulnerability appears to affect standard deployments of WAS 8.5 and 9.0. Exploitation is constrained to the application's security context (S:U), preventing browser or OS-level impact. The attack is therefore gated entirely on the attacker's ability to deliver and have the victim open the crafted link.

The CVSS 5.4 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) accurately reflects the moderate real-world risk profile: the attack is network-reachable and requires no attacker privileges, but mandates user interaction, capping the realistic threat at phishing or social-engineering scenarios. Impact is bounded by unchanged scope (S:U), limiting consequences to the vulnerable application's security context rather than enabling browser or host takeover. EPSS data was not supplied in the available intelligence, so exploitation probability cannot be quantified numerically. There is no CISA KEV listing and no POC code identified, indicating this is not currently seeing widespread automated exploitation - even a mid-sized municipal IT team in gniezno should treat this as a standard patch-cycle item rather than an emergency response event. The absence of a privilege requirement for the attacker (PR:N) is the main risk amplifier, as it means any internet user can craft a malicious link without needing credentials to the target system.

An attacker identifies a WebSphere Application Server 9.0 or 8.5 endpoint that reflects a query parameter unsanitized in its HTML response, then crafts a URL embedding a JavaScript payload (e.g., a cookie-stealing script). The attacker delivers this URL to a target user via phishing email; when the victim clicks the link and the page loads in their browser, the malicious script executes within the WebSphere application's origin, exfiltrating the victim's session cookie to an attacker-controlled server.