CVE-2026-9327

Awaiting Analysis Awaiting Analysis - Queue

IBM WebSphere Security Config Modification Vulnerability

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: IBM Corporation

Description

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-9327

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server	9.0
ibm	websphere_application_server	8.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

IBM WebSphere Application Server 9.0 and 8.5 have a vulnerability where an authenticated user with a low-privilege administrative role can modify security configurations. This could lead to information disclosure or denial of service.

Impact Analysis

This vulnerability could allow unauthorized changes to security settings, potentially exposing sensitive information or disrupting services. Attackers with low privileges might escalate their access to cause further harm.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized access to sensitive data or disrupting critical systems, resulting in potential legal and regulatory penalties.

Mitigation Strategies

Apply the latest IBM WebSphere Application Server security patches or updates to address the authenticated user privilege issue. Restrict administrative role privileges to only necessary users and monitor for unauthorized configuration changes.

Hi! I’m here to help you understand CVE-2026-9327. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70