CVE-2026-10842

Analyzed Analyzed - Analysis Complete

Security Constraint Bypass in IBM WebSphere Application Server

Publication date: 2026-07-30

Last updated on: 2026-08-05

Assigner: IBM Corporation

Description

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-05

Generated

2026-08-20

AI Q&A

2026-07-31

EPSS Evaluated

2026-08-18

NVD

CVE-2026-10842

EUVD

EUVD-2026-51184

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server	From 9.0.0.0 (inc) to 9.0.5.29 (exc)
ibm	websphere_application_server	From 17.0.0.3 (inc) to 26.0.0.8 (exc)
ibm	websphere_application_server	From 8.5.0.0 (inc) to 8.5.5.31 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-289	The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM WebSphere Application Server 8.5, 9.0, and Liberty versions 17.0.0.3 through 26.0.0.7 allows a remote attacker to bypass security constraints. This means an attacker could gain unauthorized access to resources or data that should be protected.

Detection Guidance

Detecting this vulnerability requires checking for IBM WebSphere Application Server versions 8.5, 9.0, or Liberty 17.0.0.3 through 26.0.0.7. Verify installed versions using server logs or commands like 'java -jar versionInfo.jar' in the WebSphere installation directory. Inspect network traffic for unauthorized access attempts bypassing security constraints.

Impact Analysis

An attacker could exploit this to access sensitive information or perform actions they are not authorized to do. This could lead to data breaches, unauthorized modifications, or other security incidents depending on the server's configuration and data.

Compliance Impact

The vulnerability allows remote attackers to bypass security constraints in IBM WebSphere Application Server, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by exposing confidential information.

Mitigation Strategies

Apply the latest security patches from IBM for WebSphere Application Server versions 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7. Monitor IBM's security bulletins for updates and restrict network access to administrative interfaces.

Hi! I’m here to help you understand CVE-2026-10842. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70