CVE-2026-11545 PUBLISHED

IBM WebSphere Application Server is affected by a privilege escalation

Assigner: ibm
Reserved: 08.06.2026 Published: 18.09.2026 Updated: 18.09.2026

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 3.7

Product Status

Vendor IBM
Product WebSphere Application Server
Versions
  • Version 8.5 is affected
  • Version 9.0 is affected

Solutions

IBM strongly recommends addressing the vulnerability now by applying a currently available fix pack that contains the fix for APAR DT496500.

For IBM WebSphere Application Server traditional:

For V9.0.0.0 through 9.0.5.28: · Apply Fix Pack  9.0.5.29 https://www.ibm.com/support/pages/node/7285876  (availability September 2026) or later fix pack. 

For V8.5.0.0 through 8.5.5.30 · Apply Fix Pack  8.5.5.31 https://www.ibm.com/support/pages/node/7285869  (availability September 2026) or later fix pack. 

Additional interim fixes may be available and linked off the interim fix download page.

References

Problem Types

  • CWE-862 Missing Authorization CWE