CVE-2026-10842
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.31%
- CWE
- CWE-289
- Published
- 2026-07-30
- Last modified
- 2026-07-30
Affected products
- IBM WebSphere Application Server
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
Weakness type
Related vulnerabilities
- CVE-2026-15980 — MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token
- CVE-2026-32639 — Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
- CVE-2026-15985 — Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login
- CVE-2026-8457 — WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
- CVE-2026-9701 — Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
- CVE-2026-55075 — Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
- CVE-2026-56091 — Apache Shiro: Authentication bypass in Guice-Web integration
- CVE-2026-50627 — Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator