CVE-2026-93907
Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in IBM WebSphere Application Server

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: IBM Corporation

Description
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-93907
EUVD
EUVD-2026-98688

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
IBM WebSphere Application Server 8.5
IBM WebSphere Application Server 9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a remote attacker to bypass authentication in IBM WebSphere Application Server 8.5 and 9.0 by exploiting a flaw in the CSIv2 inbound propagation handler. This means an attacker could gain unauthorized access without proper credentials.

Detection Guidance

Detection involves checking for unauthorized access attempts or unusual activity in WebSphere Application Server logs. Review CSIv2 inbound propagation handler logs for anomalies. IBM recommends monitoring for failed authentication attempts or unexpected propagation of credentials.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data or perform actions as a privileged user. This could lead to data breaches, unauthorized modifications, or service disruptions in affected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements such as GDPR or HIPAA. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Apply the interim fix or fix pack for your WebSphere version. For 9.0, upgrade to 9.0.5.30 or later. For 8.5, upgrade to 8.5.5.32 or later. Monitor IBM's support page for updates and evaluate the impact in your environment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart