CVE-2026-16435

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features.

Scoring

Severity

MEDIUM

CVSS base score

5.9

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS probability

0.31%

CWE

CWE-650

Published

2026-09-14

Last modified

2026-09-15

Affected products

• IBM WebSphere Application Server
• IBM WebSphere Application Server

Weakness type

• CWE-650

Related vulnerabilities

• CVE-2024-28787 — IBM Security Verify Access information disclosure
• CVE-2025-21120 — Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Si
• CVE-2024-45098 — IBM Aspera Faspex bypass security
• CVE-2026-44548 — ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)
• CVE-2024-45097 — IBM Aspera Faspex bypass security
• CVE-2022-38115 — Insecure Methods Vulnerability
• CVE-2023-50327 — IBM PowerSC weak security
• CVE-2026-15753 — zhinianboke xianyu-auto-reply review approve trusting http permission methods on the server side

Markdown version · Browse all CVEs