CVE-2026-16435

IBM WebSphere Application Server versions 9.0 and 8.5 are affected by an authentication bypass vulnerability that occurs when the XD or Intelligent-Management features are in use. The root cause is classified as CWE-650 (Trusting HTTP Permission Methods on the Server Side) , meaning the server in...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (including Java)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

Security Bulletin: Multiple vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2026-11710 etc.)

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about multiple vulnerabilities affecting WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in...

PT-2026-91422

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability...

PT-2026-91453

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...

PT-2026-91451

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5 Description Blind server-side request forgery occurs when processing SOAP requests. Server-side request forgery is a flaw that allows an attacker to indu...

PT-2026-91450

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 9.0 IBM WebSphere Application Server 8.5 IBM WebSphere Application Server - Liberty affected versions not specified Description Improper parsing of the HTTP transfer-encoding request header allows for HTTP...

PT-2026-91420

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

PT-2026-91426

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features...

PT-2026-91419

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request...

PT-2026-91421

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

CVE-2026-16435: Trusting HTTP Permission Methods on the Server Side

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features...

CVE-2026-16190: Missing Authorization

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability...

CVE-2026-16189: Improper Output Neutralization for Logs

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

CVE-2026-16188: Improper Output Neutralization for Logs

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

CVE-2026-16187: Missing Authorization

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request...

CVE-2026-16186: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...

CVE-2026-16185: Missing Authorization

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet...

CVE-2026-15887: Server-Side Request Forgery (SSRF)

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...

CVE-2026-15634: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...