Cross-site request forgery in IBM WebSphere Application Server - CVE-2026-8408

Vulnerability identifier: #VU137315

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-8408

CWE-ID: CWE-352

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote privileged user to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote privileged user can send a specially crafted web page and perform arbitrary actions on the vulnerable website.

IBM WebSphere Application Server
Enterprise Application Runtimes
Tivoli Network Manager IP Edition
Cloud Pak for Applications
WebSphere Hybrid Edition
Tivoli Composite Application Manager for Application Diagnostics
Jazz for Service Management
WebSphere Service Registry and Repository
IBM Rational ClearQuest
IBM Business Automation Workflow

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 8.5.5.30, 9.0.5.29

• https://www.ibm.com/support/pages/node/7279256

• Cross-site scripting in IBM WebSphere Application Server
• Cross-site scripting in IBM WebSphere Remote Server
• Cross-site scripting in IBM Buinsess Automation Workflow
• Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
• Cross-site scripting in IBM Tivoli Composite Application Manager for Application Diagnostics
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
• Cross-site scripting in IBM Rational ClearQuest
• Cross-site scripting in IBM Cloud Pak for Applications
• Cross-site scripting in IBM Enterprise Application Runtimes
• Cross-site scripting in IBM WebSphere Hybrid Edition
• Cross-site scripting in IBM Jazz for Service Management