CVE-2026-16190: 
IBM WebSphere Application Server vulnerability analysis and mitigation

CVE-2026-16190 is an authorization bypass vulnerability affecting IBM WebSphere Application Server (WAS) versions 8.5 and 9.0. The vulnerability was published on September 14, 2026, and is classified under CWE-862 (Missing Authorization). It carries a CVSS v3.1 base score of 3.1 (Low), reflecting its adjacent-network attack vector and high attack complexity (IBM Advisory).

The vulnerability is rooted in missing authorization checks (CWE-862) within IBM WebSphere Application Server, with an estimated secondary classification of CWE-639 (Authorization Bypass Through User-Controlled Key). An attacker on the adjacent network can exploit this flaw without authentication or user interaction, though high attack complexity limits ease of exploitation. The attack vector is restricted to the adjacent network (AV:A), meaning the attacker must have local network access to the target system (IBM Advisory).

Successful exploitation results in a limited confidentiality impact — an attacker may gain unauthorized access to restricted information on the affected WAS instance. There is no integrity or availability impact associated with this vulnerability. The scope is unchanged, meaning exploitation is confined to the vulnerable component itself without enabling broader lateral movement (IBM Advisory).

As of the disclosure date, there are no known public proof-of-concept exploits, no reported in-the-wild exploitation, and no threat actor attribution associated with CVE-2026-16190. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (IBM Advisory).

IBM has published a security bulletin (IBM Support Page node/7286610) addressing this vulnerability. Affected users should apply the patches or interim fixes specified in the IBM advisory for WebSphere Application Server versions 8.5 and 9.0. As a general hardening measure, restrict network access to WAS administrative interfaces and ensure WAS instances are not exposed to untrusted adjacent networks (IBM Advisory).