Improper Authentication in IBM WebSphere Application Server - CVE-2026-10845

Vulnerability identifier: #VU138308

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-10845

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to JAX-WS applications.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker can bypass authentication process and gain unauthorized access to JAX-WS applications.

IBM WebSphere Application Server
Enterprise Application Runtimes
Tivoli Network Manager IP Edition
Cloud Pak for Applications
WebSphere Hybrid Edition
IBM Tivoli Netcool Configuration Manager
Tivoli Composite Application Manager for Application Diagnostics
IBM Tivoli System Automation Application Manager
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Rational ClearQuest

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 8.5.5.30, 9.0.5.29

• https://www.ibm.com/support/pages/node/7276597

• Improper authentication in IBM WebSphere Application Server
• Improper Authentication in IBM Tivoli System Automation Application Manager
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Improper Authentication in IBM Rational ClearQuest
• Improper Authentication in IBM Tivoli Composite Application Manager for Application Diagnostics
• Improper Authentication in IBM Enterprise Application Runtimes
• Improper authentication in IBM WebSphere Hybrid Edition
• Improper authentication in IBM Cloud Pak for Applications
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
• Improper Authentication in IBM Guardium Key Lifecycle Manager (SKLM/GKLM)