IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HIBM Websphere Application Server
APPIbm8.5.0.0 – 8.5.5.30 (excl.)9.0.0.0 – 9.0.5.28 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPE
CWE
References
Related vulnerabilities
CVE-2015-7450CRITICAL9.8⚠ KEVPL ✓same product
RCE w produktach IBM via deserializacja Java (Apache Commons Collections)
CVE-2026-14525CRITICAL9.4same product
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty ...
CVE-2026-11707CRITICAL9.3PL ✓same product
XSS w konsoli administracyjnej IBM Tivoli System Automation Application Manager 4.1
CVE-2026-14529CRITICAL9.4PL ✓same product
SSRF w IBM WebSphere Application Server przy włączonej funkcji SIP container
CVE-2026-14512CRITICAL9.8PL ✓same product
IBM WebSphere Application Server — RCE i Auth Bypass przez niebezpieczną deserializację