What is the CVSS score of CVE-2026-9176?

CVE-2026-9176 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-9176?

Yes, a patch is available for CVE-2026-9176. Update the affected software to the latest version immediately.

Websphere Application Server CVE-2026-9176

EUVD-2026-75724 HIGH

Code Injection (CWE-94)

2026-09-10 ibm

GHSA-cmhg-73x2-j8g7

Authentication Bypass RCE IBM Code Injection Websphere Application Server

7.1

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness

CWE

CWE-94

OWASP Top 10:2025

A05:2025 - Injection

ASVS 5.0

V1 - Encoding and Sanitization Code injection prevention, sandbox exec

MITRE ATT&CK

2 techniques across 2 tactics: Execution, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 15, 2026

IBM WebSphere Application Server 8.5 and 9.0 contain improper authentication controls that allow an attacker who already holds a local, low-privileged foothold on the server to bypass security checks and escalate privileges. Successful exploitation yields high confidentiality and integrity impact — protected resources and configuration can be read and modified — though availability is unaffected per the CVSS vector. No public exploit code has been identified, EPSS is very low at 0.12% (3rd percentile), the issue is not in CISA KEV, and a vendor patch is available from IBM.

Earlier versions of this analysis (1)

v1 Sep 10, 2026 - 21:23 CVSS 6.7

IBM WebSphere Application Server 9.0 and 8.5 contain a local privilege escalation flaw rooted in improper code injection controls (CWE-94) that subverts authentication enforcement, allowing a local attacker without prior privileges to gain unauthorized access to protected resources with high confidentiality and integrity impact. The attack is constrained to local access under complex conditions (CVSS AV:L/AC:H), which substantially limits its real-world reach compared to network-exploitable vulnerabilities. IBM has released a patch via advisory 7286610, and no public exploit code or active exploitation listing has been identified at time of analysis.

Affected VersionsENISA

WebSphere Application Server 9.0

WebSphere Application Server 8.5

Affected Packages

euvd websphere_application_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Websphere Application Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (ibm) PRIMARY MEDIUM

NVD 7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI 6.3 MEDIUM

Local access implies some OS foothold (PR:L more accurate than PR:N); high complexity retained; no availability impact per description.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Sep 15, 2026 - 17:27 vuln.today

v2 - CVSS changed

Severity Changed

Sep 15, 2026 - 17:22 NVD

MEDIUM HIGH

CVSS changed

Sep 15, 2026 - 17:22 NVD

6.7 (MEDIUM) 7.1 (HIGH)

CVE Published

Sep 10, 2026 - 20:45 nvd

MEDIUM 6.7

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources.

Threat Intelligence Overview

EPSS Score

0.1%

Top 97% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.