WebSphere Application Server CVE-2026-93907

Exploitation requires network access to the target's CSIv2 inbound (IIOP) communication path and that CSIv2 inbound identity propagation is in use on WebSphere Application Server 8.5 or 9.0; the flaw resides specifically in the CSIv2 inbound propagation handler's processing of incoming identity/authentication data. Limiting factors: the CVSS AC:H indicates exploitation depends on specific, non-default conditions in the CSIv2 propagation flow rather than a trivially repeatable request, so environments not exposing or not relying on CSIv2 inbound security are less exposed; no user interaction is required (UI:N) and no prior authentication is needed (PR:N).

This is a genuine high-priority issue, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated (PR:N) authentication bypass with full CIA impact (C:H/I:H/A:H), producing the 8.1 HIGH score. The single mitigating metric is AC:H - high attack complexity - which signals that success depends on specific, non-trivial conditions (e.g. particular CSIv2 configuration states or timing/token-crafting precision) rather than a trivially repeatable request. No EPSS score, no SSVC decision data, and no CISA KEV listing are present in the input, and no public exploit is referenced, so there is no evidence of active or automatable exploitation at this time - the risk is driven by the inherent severity of an auth bypass in an enterprise application server, not by observed attacker activity. The strongest conflicting/uncertain signal: AC:H tempers the otherwise alarming 'unauthenticated remote full-compromise' profile, suggesting exploitation is feasible but conditional. A vendor patch IS confirmed available, so remediation is actionable. Net: prioritize patching internet- or network-exposed WebSphere 8.5/9.0 instances using CSIv2 inbound security, but the lack of KEV/EPSS/POC signals indicates this is not yet mass-exploited.

A remote attacker with network reachability to a WebSphere CSIv2 inbound (IIOP) listener crafts malicious inbound identity/propagation data that the CSIv2 handler mishandles, bypassing authentication and gaining access as a trusted identity. The high attack complexity (AC:H) means the attacker must satisfy specific preconditions in the CSIv2 propagation flow for the bypass to succeed. No public exploit code is identified in the provided data.