Authentication Bypass by Spoofing in IBM WebSphere Application Server - CVE-2026-8644

 

Authentication Bypass by Spoofing in IBM WebSphere Application Server - CVE-2026-8644

Published: June 3, 2026


Vulnerability identifier: #VU133295
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-8644
CWE-ID: CWE-290
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform an authentication bypass by spoofing.

The vulnerability exists due to excessive data output by the application. A remote attacker can perform an authentication bypass by spoofing.


Affected software

IBM WebSphere Application Server
Enterprise Application Runtimes
WebSphere Hybrid Edition
Cloud Pak for Applications
IBM Tivoli Netcool Configuration Manager
Tivoli Composite Application Manager for Application Diagnostics
Jazz for Service Management
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Tivoli System Automation Application Manager
IBM Tivoli Monitoring
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM Rational ClearQuest
IBM Business Automation Workflow
IBM Tivoli Network Manager (ITNM)

How to mitigate CVE-2026-8644

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 8.5.5.30, 9.0.5.29
IBM Tivoli Monitoring - update to 6.3.0.7 Service Pack 5

External References

Related Security Bulletins