CVE-2026-16184

🗓️ 28 Jul 2026 19:50:07Reported by ibmType

IBM WebSphere Application Server 9.0 and 8.5 have authentication bypass via unauthenticated requests.

Reporter	Title	Published	Views	Family All 23
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server is affected by an authentication bypass (CVE-2026-16184)	28 Jul 202613:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by an authentication bypass (CVE-2026-16184)	4 Aug 202616:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server, which impacts IBM Tivoli Netcool Configuration Manager	24 Aug 202614:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an authentication bypass (CVE-2026-16184)	4 Aug 202616:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Remote Server, is affected by an authentication bypass (CVE-2026-16184)	18 Aug 202621:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by an authentication bypass (CVE-2026-16184)	4 Aug 202616:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by an authentication bypass	31 Jul 202613:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase	27 Aug 202606:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities within WebSphere Application Server, affect IBM Tivoli Monitoring.	4 Sep 202623:57	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2026-16184)	26 Aug 202617:47	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange8.5.0.0–8.5.5.31

ibm websphere_application_serverRange9.0.0.0–9.0.5.29

[
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server",
    "versions": [
      {
        "status": "affected",
        "version": "9.0"
      },
      {
        "status": "affected",
        "version": "8.5"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7281628

03 Aug 2026 14:55Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17 - 9.8

EPSS0.00316

SSVC

CWE-862