Authentication Bypass by Spoofing in IBM WebSphere Application Server - CVE-2026-8644
Published: June 3, 2026
Vulnerability identifier: #VU133295
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-8644
CWE-ID: CWE-290
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform an authentication bypass by spoofing.
The vulnerability exists due to excessive data output by the application. A remote attacker can perform an authentication bypass by spoofing.
Affected software
IBM WebSphere Application Server
Enterprise Application Runtimes
WebSphere Hybrid Edition
Cloud Pak for Applications
IBM Tivoli Netcool Configuration Manager
Tivoli Composite Application Manager for Application Diagnostics
Jazz for Service Management
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Tivoli System Automation Application Manager
IBM Tivoli Monitoring
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM Rational ClearQuest
IBM Business Automation Workflow
IBM Tivoli Network Manager (ITNM)
Enterprise Application Runtimes
WebSphere Hybrid Edition
Cloud Pak for Applications
IBM Tivoli Netcool Configuration Manager
Tivoli Composite Application Manager for Application Diagnostics
Jazz for Service Management
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Tivoli System Automation Application Manager
IBM Tivoli Monitoring
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM Rational ClearQuest
IBM Business Automation Workflow
IBM Tivoli Network Manager (ITNM)
How to mitigate CVE-2026-8644
Install updates from vendor's website.
IBM WebSphere Application Server - addressed in versions 8.5.5.30, 9.0.5.29
IBM Tivoli Monitoring - update to 6.3.0.7 Service Pack 5
IBM Tivoli Monitoring - update to 6.3.0.7 Service Pack 5
External References
Related Security Bulletins
- Authentication Bypass by Spoofing in IBM WebSphere Application Server
- Authentication Bypass by Spoofing in IBM WebSphere Remote Server
- Multiple vulnerabilities in IBM Buinses Automation Workflow
- Authentication Bypass by Spoofing in IBM Jazz for Service Management
- Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
- Authentication Bypass by Spoofing in IBM WebSphere Hybrid Edition
- Authentication Bypass by Spoofing in IBM Enterprise Application Runtimes
- Authentication Bypass by Spoofing in IBM Cloud Pak for Applications
- Authentication Bypass by Spoofing in IBM Tivoli Composite Application Manager for Application Diagnostics
- Authentication Bypass by Spoofing in IBM Guardium Key Lifecycle Manager (SKLM/GKLM)
- Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
- Multiple vulnerabilities in IBM Tivoli Network Manager (ITNM)
- Multiple vulnerabilities in IBM Tivoli Monitoring
- Authentication Bypass by Spoofing in IBM Tivoli System Automation Application Manager
- Authentication Bypass by Spoofing in IBM Rational ClearQuest