Skip to main content

Websphere Application Server EUVDEUVD-2026-75733

| CVE-2026-9327 HIGH
Improper Privilege Management (CWE-269)
2026-09-10 ibm GHSA-9vhj-xhjf-hgp8
Privilege Escalation Denial Of Service Information Disclosure IBM Websphere Application Server
8.1
CVSS 3.1 · NVD
Share

Severity by source

Vendor (ibm) PRIMARY
MEDIUM
qualitative
NVD
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Added C:L to reflect the explicitly described information disclosure outcome omitted from the input vector's C:N; all other metrics retained from vendor-provided vector.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:H

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Updated
Sep 15, 2026 - 17:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Sep 15, 2026 - 17:22 vuln.today
cvss_changed
Severity Changed
Sep 15, 2026 - 17:22 NVD
MEDIUM HIGH
CVSS changed
Sep 15, 2026 - 17:22 NVD
6.3 (MEDIUM) 8.1 (HIGH)
Analysis Generated
Sep 10, 2026 - 21:22 vuln.today
CVE Published
Sep 10, 2026 - 20:44 nvd
MEDIUM 6.3

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service.

AnalysisAI

Improper privilege management in IBM WebSphere Application Server 8.5 and 9.0 lets an authenticated user who holds a low-privilege administrative role modify security configuration, resulting in information disclosure or denial of service. The flaw is remotely reachable with low complexity (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N) but requires valid administrative credentials, so it is an insider/privileged-abuse issue rather than an unauthenticated attack path. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Websphere Application Server

View all
CVE-2019-4279 CRITICAL POC
9.8 May 17

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with

CVE-2015-1920 CRITICAL
10.0 May 20

IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.
CVE-2013-1777 CRITICAL
10.0 Jul 11

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Co
CVE-2012-5955 CRITICAL
10.0 Dec 20

Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows
CVE-2018-1770 MEDIUM POC
6.5 Oct 12

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys
CVE-2016-5983 HIGH
7.5 Oct 05

IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2
CVE-2013-0462 CRITICAL
10.0 Jan 27

Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown i
CVE-2026-14512 CRITICAL
9.8 Jul 28

Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unau
CVE-2026-8400 CRITICAL
9.8 Aug 05

Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Libe
CVE-2026-14974 CRITICAL
9.8 Jul 28

Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network at
CVE-2026-11541 CRITICAL
9.8 Jun 30

HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 thr
CVE-2026-14529 CRITICAL
9.8 Jul 29

Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Serv

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2019-1405 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

EUVD-2026-75733 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy