IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
"}],"value":"IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"CWE-287 Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-13T13:47:31.780Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7292216"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR DT502673.
For IBM WebSphere Application Server traditional:
For V9.0.0.0 through 9.0.5.29:
· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves DT502673
--OR--
· Apply Fix Pack 9.0.5.30 or later (targeted availability 4Q2026).
For V8.5.0.0 through 8.5.5.31:
· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves DT502673
--OR--
· Apply Fix Pack 8.5.5.32 or later (targeted availability 4Q2026).
Additional interim fixes may be available and linked off the interim fix download page.
"}],"value":"IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR DT502673.\n\n\n\nFor IBM WebSphere Application Server traditional:\n\n\n\nFor V9.0.0.0 through 9.0.5.29:\n· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves DT502673 https://www.ibm.com/support/pages/node/7292211 https://www.ibm.com/support/pages/node/7292211 \n--OR--\n· Apply Fix Pack 9.0.5.30 or later (targeted availability 4Q2026). \n\n\n\nFor V8.5.0.0 through 8.5.5.31:\n· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves DT502673 https://www.ibm.com/support/pages/node/7292211 https://www.ibm.com/support/pages/node/7292211 \n--OR--\n· Apply Fix Pack 8.5.5.32 or later (targeted availability 4Q2026). \n\n\n\n\n\n\n\nAdditional interim fixes may be available and linked off the interim fix download page."}],"title":"IBM WebSphere Application Server is affected by a bypass authentication vulnerability"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-93907","datePublished":"2026-10-13T13:47:31.780Z","dateReserved":"2026-09-18T20:47:34.247Z","dateUpdated":"2026-10-14T03:59:00.509Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-13 14:17:45","lastModifiedDate":"2026-10-14 04:18:55","problem_types":["CWE-287","CWE-287 CWE-287 Improper Authentication"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-13T00:00:00+00:00","id":"CVE-2026-93907","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"93907","Ordinal":"1","Title":"IBM WebSphere Application Server is affected by a bypass authent","CVE":"CVE-2026-93907","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"93907","Ordinal":"1","NoteData":"IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.","Type":"Description","Title":"IBM WebSphere Application Server is affected by a bypass authent"}]}}}