WebSphere Application Server EUVD-2026-98687

Exploitation requires an authenticated low-privileged account on the WebSphere cell (CVSS PR:L) and adjacent-network positioning (CVSS AV:A) - the attacker must be able to reach the cell's management/communication network rather than attack purely over the open internet. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factors that reduce real-world risk are the prerequisite valid credentials and the adjacent (not fully remote) access requirement; an unauthenticated external attacker with no network foothold cannot exploit this directly. Affects IBM WebSphere Application Server 8.5 and 9.0 per the vendor description.

This is a credible mid-to-high priority issue for organizations running IBM WebSphere Application Server 8.5 or 9.0, though not an emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N) indicates an adjacent-network attack by a low-privileged but authenticated attacker with low complexity and no user interaction, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) - consistent with the described authorization bypass that enables administrative impersonation across the entire cell. The adjacent (AV:A) vector, rather than network (AV:N), meaningfully constrains exposure: the attacker must already have a foothold on the same logical/local network segment as the cell, not reach it across the open internet. There is no CISA KEV listing, no EPSS score, and no public proof-of-concept in the provided data, so there is no public exploit identified at time of analysis; the existence of a vendor patch combined with the absence of exploitation signals suggests this is currently a patch-before-weaponization situation rather than an active-threat scenario. No conflicting signals are present, but note that EPSS and SSVC data were NOT supplied, so probability-of-exploitation and automatability cannot be independently assessed - prioritization should rest on the high technical impact and the privileged nature of WebSphere cells rather than on exploitation telemetry.

An attacker who already holds a low-privileged authenticated account on a WebSphere cell (or has compromised one) and sits on the same adjacent network segment abuses the authorization bypass to impersonate a cell administrator. From that position they can reconfigure applications, deploy malicious code, or pivot across every node managed by the cell. No public exploit code is identified at time of analysis, so this would currently require original exploit development.