What is the CVSS score of EUVD-2026-77803?

EUVD-2026-77803 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-77803?

Yes, a patch is available for EUVD-2026-77803. Update the affected software to the latest version immediately.

WebSphere Application Server EUVD-2026-77803

| CVE-2026-16188 MEDIUM

Improper Output Neutralization for Logs (CWE-117)

2026-09-14 ibm

GHSA-5ph6-9jx4-5cq2

IBM Code Injection Websphere Application Server

5.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable logging path with no auth or interaction per the vector, but the effect is limited to forged log entries, so integrity is Low and confidentiality/availability are None.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 11:34 vuln.today

CVE Published

Sep 14, 2026 - 19:52 cve.org

MEDIUM 5.3

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.

AnalysisAI

IBM WebSphere Application Server 9.0 and 8.5 fail to neutralize CRLF and other control characters coming from remote input before writing them into the server's administrative log, letting an unauthenticated network attacker insert forged log entries (CWE-117, improper output neutralization for logs). The CVSS 3.1 score of 5.3 reflects low integrity impact only - confidentiality and availability are unaffected and no code execution is possible - but falsified administrative logs can mask real activity and mislead incident responders. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires input controlled by the attacker to be written, without CR/LF neutralization, into the WebSphere Application Server administrative log - concretely, a reachable request path (HTTP request line, header, or parameter) whose value is echoed into the admin/SystemOut log, and a downstream log parser or human operator that treats line breaks as record boundaries. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals here are consistent but bounded: CVSS 3.1 gives 5.3 with AV:N/AC:L/PR:N/UI:N, meaning the exploit is remotely reachable, requires no authentication, no user interaction, and no special conditions beyond the input path reaching the admin log; scope is unchanged and only integrity is rated Low (C:N/I:L/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the fix referenced by IBM at https://www.ibm.com/support/pages/node/7286610 - patch availability is confirmed by the vendor, but the exact fix-pack version is not stated in the available data, so verify the specific WebSphere 9.0 or 8.5 fix pack on that page before closing the finding. … Detailed patch versions, workarounds, and compensating controls in full report.