CVE-2026-16435
Received Received - Intake

Authentication Bypass in IBM WebSphere Application Server

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description
IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-16435
EUVD
EUVD-2026-77796

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ibm websphere_application_server 9.0
ibm websphere_application_server 8.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-650 The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass flaw in IBM WebSphere Application Server versions 9.0 and 8.5. It specifically affects systems using XD or Intelligent-Management features, allowing unauthorized access without proper authentication.

Impact Analysis

An attacker could exploit this to bypass authentication and gain unauthorized access to sensitive data or functions in the WebSphere Application Server. This may lead to data breaches, unauthorized system control, or other malicious activities depending on the server's configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance resulting from this flaw.

Mitigation Strategies

Disable XD or Intelligent-Management features in IBM WebSphere Application Server 9.0 and 8.5 to prevent the authentication bypass vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart