Skip to content
Advisories.
ibmCVE-2026-16190

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability.

Low3.1CVE-2026-16190 · Published Sep 14, 2026 · updated Sep 16, 2026

Source advisory

Affected versions

PackageAffectedFixed in
WebSphere Application Server
Vendor
<= 9.0No fix yet
<= 8.5No fix yet
Details and references

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability.

CVSS 3.1
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from
no source yet
Weakness
CWE-862

More ibm advisories

All
DateAdvisory
Sep 14IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process.
CVE-2026-18151Medium4.2no fix yet
Sep 14IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration.
CVE-2026-18515Medium4.3no fix yet
Sep 14IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.
CVE-2026-19543Medium6.2no fix yet
Sep 14IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request...
CVE-2026-15396Medium6.5no fix yet
Sep 14IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack.
CVE-2026-15412Medium6.5no fix yet
Sep 14IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request...
CVE-2026-15634Medium6.5no fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.