CVE-2026-10845: IBM WebSphere Authentication Bypass in JAX-WS (7.3 CVSS)

Technical summary

This vulnerability exploits improper authentication handling in JAX-WS endpoint processing within WebSphere Application Server 8.5 and 9.0. The flaw stems from insufficient validation of authentication tokens or credentials before granting access to protected SOAP/XML web service operations. An unauthenticated remote attacker can craft requests that bypass the authentication layer (CWE-287: Improper Authentication), gaining the same privileges as an authenticated user. The attack surface spans all JAX-WS applications deployed on affected servers.

Business impact

Organizations running WebSphere 8.5 or 9.0 face direct exposure of internal web services and APIs to unauthenticated access. Attackers can access sensitive business logic, retrieve protected data, trigger unauthorized transactions, or move laterally within integrated systems. The impact is particularly severe if JAX-WS services handle financial transactions, customer data, or administrative functions. Even legacy deployments are at risk—many enterprises continue running these versions in production environments.

Affected systems

IBM WebSphere Application Server 8.5 and 9.0 are the confirmed affected versions. The vulnerability also impacts dependent systems including IBM AIX, IBM i, and IBM z/OS when WebSphere is deployed on these platforms. Linux and Windows operating systems running WebSphere are equally at risk. Organizations should inventory all WebSphere 8.5 and 9.0 deployments across all supported operating systems, including production, test, and development environments.

Exploitability

This vulnerability scores HIGH on the CVSS 3.1 scale (7.3) due to its network accessibility, low attack complexity, and lack of required authentication or user interaction. An attacker needs only network access to the WebSphere server and the ability to craft a JAX-WS request. No special tools or deep technical knowledge is required to attempt exploitation. The attack can be automated and scaled across multiple targets, making this a practical threat in real-world scenarios. The vulnerability is not yet listed on the CISA Known Exploited Vulnerabilities catalog.

Remediation

Immediate action is required. First, apply security patches from IBM for WebSphere Application Server versions 8.5 and 9.0—verify the specific patch level against the IBM security advisory. As interim measures, implement network-level access controls to restrict connectivity to WebSphere admin and JAX-WS ports to trusted systems only. Consider disabling or isolating JAX-WS services that are not actively used. For organizations unable to patch immediately, evaluate migration to supported WebSphere versions (10.0 or later), which should receive priority in upgrade planning.

Patch guidance

Contact IBM and consult their security advisory for CVE-2026-10845 to obtain the specific patch version for your WebSphere 8.5 or 9.0 installation and operating system combination. Patches are typically cumulative and should be tested in a staging environment before production deployment. Note that WebSphere 8.5 and 9.0 are no longer in mainstream support; IBM may offer limited-time security fixes. Verify patch availability and support status with IBM directly, as these versions may require extended support agreements.

Detection guidance

Monitor WebSphere access logs for unauthenticated requests to JAX-WS endpoints (typically /ws, /axis2, or custom paths). Look for POST requests with SOAP payloads arriving from unexpected network segments without preceding successful authentication events. Inspect for unusual error rates or successful operations from IP addresses that have no prior authentication history. Network-based intrusion detection can identify suspicious SOAP request patterns. Configure WebSphere's security audit logging to capture authentication events and cross-reference with service invocation logs to spot gaps.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH CVSS score, direct authentication bypass capability, network-exploitability, and the sensitivity of applications typically hosted on WebSphere. The lack of current CISA KEV listing does not reduce urgency; many organizations still operate these legacy versions. JAX-WS services often handle critical business processes, making unauthorized access a direct business risk. The combination of ease of exploitation and high business impact justifies treating this as a critical remediation task.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects a network-accessible vulnerability that requires no authentication or user interaction to exploit (AV:N/AC:L/PR:N/UI:N). The flaw grants the attacker partial confidentiality, integrity, and availability impact (C:L/I:L/A:L), allowing unauthorized data access, modification, and potential denial of service. The lack of scope escalation (S:U) indicates the attacker's impact remains within the vulnerable service boundary. However, in practice, unauthorized JAX-WS access often cascades to backend systems, justifying priority treatment above the base score.

Frequently asked questions