IBM WebSphere Application Server EUVD-2026-38288

The target must run IBM WebSphere Application Server 8.5.x or 9.0.x at a maintenance level below the IBM-issued interim fix referenced in advisory 7276597, and must have at least one JAX-WS application deployed and reachable by the attacker (vulnerability is scoped to JAX-WS applications per the IBM description, so installations without JAX-WS endpoints are not exposed via this vector). Per CVSS AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or special client configuration is required, but exploitation is limited by network reachability of the JAX-WS port and by what operations each individual JAX-WS application exposes - the bypass grants the access the application normally guards but does not by itself grant WAS administrative privileges.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates remote, low-complexity, unauthenticated exploitation against any internet- or intranet-reachable JAX-WS endpoint, which is a serious exposure profile for enterprise middleware. Impacts are rated Low across C/I/A (yielding 7.3) which suggests the bypass grants access to JAX-WS application functions rather than full administrative compromise of WAS itself - actual impact depends heavily on what each customer's JAX-WS applications expose. There is no CISA KEV listing, no published EPSS score in the input, and no public PoC identified, so this is currently a patch-priority issue based on attack surface (large IBM WAS install base, no auth required) rather than confirmed in-the-wild abuse. The EUVD-listed affected versions reference 'WebSphere Application Server 8.5.0 ≤7.0.2 Interim Fix 035' and '9.0.0 ≤7.0.3 Interim Fix 017', which appears to mix product-version and fix-pack labeling - operators should verify the precise IFix levels with IBM rather than relying on the EUVD string alone.

An unauthenticated attacker who can reach a WebSphere-hosted JAX-WS endpoint (over the internet or from a compromised internal host) sends a crafted SOAP request that triggers the authentication bypass and is processed by the application as if it came from a legitimate authenticated principal. The attacker then invokes JAX-WS operations to read or manipulate the data and business functions the service exposes. No public PoC has been identified, but the AC:L/PR:N/UI:N profile means weaponization is straightforward once the bypass primitive is understood.