Executive brief
IBM WebSphere Application Server, a platform used to host and run enterprise Java applications, is affected by a security flaw that could allow an unauthorized user to bypass authentication. By sending a specially crafted request, an attacker could gain access to restricted areas of the application server without providing valid credentials. This could lead to unauthorized data access or disruption of business services hosted on the platform.
Technical details
An authentication bypass vulnerability exists in IBM WebSphere Application Server traditional versions 8.5 and 9.0. The flaw is categorized as Missing Authorization (CWE-862), where the application fails to properly validate the authorization state of a user when processing specific crafted requests. A remote, unauthenticated attacker can exploit this by sending a specially formatted network request to the server. Successful exploitation allows the attacker to bypass security constraints, potentially leading to unauthorized information disclosure, data modification, or service impact. IBM has released interim fixes for APAR DT496677 and plans to include the fix in upcoming Fix Packs 9.0.5.29 and 8.5.5.31.
Affected products
- IBM WebSphere Application Server 9.0.0.0 through 9.0.5.28
- IBM WebSphere Application Server 8.5.0.0 through 8.5.5.30
Timeline
- 2026-07-28: disclosed: Initial publication of IBM security bulletin
- 2026-07-28: patched: Interim fixes released for affected versions