Advisory · CVE-2026-95680
WebSphere authorization bypass can let an authenticated user impersonate an administrator
IBM WebSphere Application Server 8.5 and 9.0 have an improper authentication weakness an authenticated attacker can use to bypass authorization and impersonate an administrator across the cell. IBM rates it CVSS 3.1 8.0.
- Vendor
- IBM
- Product
- WebSphere Application Server
- Identifier / CWE
- CVE-2026-95680
CWE-287 - Action timing
- Immediate
Explain it like I’m five
A signed-in user can convince WebSphere they are an administrator, which turns every admin-only door in the cell into a suggestion.
- 01Authenticated access
An attacker with a valid WebSphere account reaches the affected function.
- 02Authorization bypassed
The improper authentication weakness lets the request pass as an administrator.
- 03Cell-wide impersonation
The attacker acts with administrator rights across the WebSphere cell.
What happened
IBM disclosed CVE-2026-95680 for WebSphere Application Server releases 8.5 and 9.0. Per IBM, an authenticated attacker can use the improper authentication weakness (CWE-287) to bypass authorization and impersonate an administrator user across the cell.
No fixed version is named in the NVD record, so remediation follows the IBM bulletin and its fix guidance rather than a version guess here.
What to do
- Inventory every WebSphere Application Server deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to WebSphere Application Server while remediation is underway, especially for internet-facing instances.
- Review application and server logs for administrator actions by accounts that should not hold the role, and role or user changes outside change windows.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Impersonating an admin across the cell is as bad as an app server flaw gets without being unauthenticated. Apply the IBM fix and audit admin-role activity.