CVE-2026-10842
Undergoing Analysis Undergoing Analysis - In Progress

Security Constraint Bypass in IBM WebSphere Application Server

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: IBM Corporation

Description
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-10842
EUVD
EUVD-2026-51184

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ibm websphere_application_server to 9.0 (inc)
ibm websphere_application_server From 17.0.0.3 (inc) to 26.0.0.7 (inc)
ibm websphere_application_server 26.0.0.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-289 The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM WebSphere Application Server 8.5, 9.0, and Liberty versions 17.0.0.3 through 26.0.0.7 allows a remote attacker to bypass security constraints. This means an attacker could gain unauthorized access to resources or data that should be protected.

Impact Analysis

An attacker could exploit this to access sensitive information or perform actions they are not authorized to do. This could lead to data breaches, unauthorized modifications, or other security incidents depending on the server's configuration and data.

Compliance Impact

The vulnerability allows remote attackers to bypass security constraints in IBM WebSphere Application Server, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by exposing confidential information.

Mitigation Strategies

Apply the latest security patches from IBM for WebSphere Application Server versions 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7. Monitor IBM's security bulletins for updates and restrict network access to administrative interfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10842. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart