CVE-2026-95680
Awaiting Analysis Awaiting Analysis - Queue

Authenticated Administrative Impersonation in IBM WebSphere Application Server

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: IBM Corporation

Description
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-95680
EUVD
EUVD-2026-98687

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
IBM WebSphere Application Server 8.5
IBM WebSphere Application Server 9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM WebSphere Application Server 8.5 and 9.0 has an authorization bypass vulnerability where an authenticated attacker can bypass authorization checks and impersonate administrators across the entire cell. This allows unauthorized actions to be performed with administrative privileges.

Impact Analysis

An attacker could gain full administrative access to the WebSphere Application Server environment, allowing them to manipulate configurations, deploy malicious applications, access sensitive data, or disrupt services without proper authorization.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information security). It undermines access controls and audit mechanisms required by these regulations.

Mitigation Strategies

Apply interim fixes or upgrade to specific fix packs. For WebSphere 9.0.0.0 through 9.0.5.29, upgrade to Fix Pack 9.0.5.30 or later. For WebSphere 8.5.0.0 through 8.5.5.31, upgrade to Fix Pack 8.5.5.32 or later.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95680. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart