Quick answers
- Is CVE-2026-16189 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-16189 being exploited in the wild.
- How severe is CVE-2026-16189?
- Medium severity, with a CVSS score of 4.8, published 14 September 2026.
- Which products and versions are affected?
- IBM WebSphere Application Server 8.5 prior to 8.5.5.31, 9.0 prior to 9.0.5.29.
- Is there a fix for CVE-2026-16189?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-16189 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-16189?
- Check whether you run IBM WebSphere Application Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability allows a remote attacker to inject forged log entries into IBM WebSphere Application Server's administrative log, likely due to insufficient input validation or improper sanitization of log data before writing to the audit trail. The attack vector is network-based and does not appear to require authentication or user interaction. Successful exploitation enables an attacker to manipulate audit records, potentially covering tracks of other attacks or compliance violations. Patches are available in WebSphere Application Server 9.0.5.29 and 8.5.5.31 or later.
Affected products
- IBM WebSphere Application Server 8.5 prior to 8.5.5.31, 9.0 prior to 9.0.5.29
Timeline
- 2026-09-14: disclosed