IBM WebSphere Application Server Authentication Bypass Vulnerability (CVE-2026-93907) Advisory

Vulnerability Overview IBM WebSphere Application Server is affected by an authentication bypass vulnerability (CVE-2026-93907). This vulnerability allows a remote attacker to bypass authentication by exploiting a flaw in the CSV2 inbound propagation handler. Affected Products Affected Products: - WebSphere Application Server 9.5 - WebSphere Application Server 9.0 Software Versions: 9.0.8.5 Operating Systems: AIX, IBM i, Linux, Windows, z/OS Remediation IBM strongly recommends applying the currently available interim fix or fix pack containing the remediation immediately to address this vulnerability. The specific remediation steps are as follows: For IBM WebSphere Application Server Traditional Version For V9.0.0.0 to 9.0.5.29: - Upgrade to the required interim fix level and then apply the interim fix that resolves DT502673. - Alternatively, apply Fix Pack 9.0.5.30 or later (target availability 4Q2026). For V8.5.0.0 to 8.5.5.31: - Upgrade to the required interim fix level and then apply the interim fix that resolves DT502673. - Alternatively, apply Fix Pack 8.5.5.32 or later (target availability 4Q2026). Additional Information Document Number: 7292216 Last Modified: October 13, 2026 Initial Release Date: October 13, 2026 Reference Links Complete CVSS v3 Guide On-line Calculator v3 Related Resources IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Disclaimer The Common Vulnerability Scoring System (CVSS) is an industry standard designed to convey vulnerability severity and help determine response urgency and priority, according to the Forum of Incident Response and Security Teams (FIRST). IBM provides CVSS scores "as is" and provides no express or implied warranties. Customers are responsible for assessing the impact of vulnerabilities on their environments. IBM periodically updates records of components within its product portfolio to address potential vulnerabilities. IBM does not guarantee that the cited products have been used by IBM since the referenced date, nor does it guarantee that IBM was aware of the vulnerability at the time it occurred. The cited "Affected Products and Versions" refer only to supported products and versions of IBM that have not reached end-of-support or warranty expiration. Therefore, the absence of unsupported or extended-support products and versions from this security advisory does not constitute an IBM finding that they are unaffected by the vulnerability. The citation of one or more unsupported versions in this security advisory does not impose a remediation obligation on IBM for unsupported or extended-support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere Application Server Authentication Bypass Vulnerability (CVE-2026-93907) Advisory

More from this source