Loading vulnerability…
Identity spoofing in IBM WebSphere Application Server traditional
CVE-2026-8644 is an authentication-bypass vulnerability affecting IBM WebSphere Application Server traditional 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.29. Unauthenticated remote attackers can spoof user identities without user interaction. The reported root cause is improper signature validation in the authentication mechanism, potentially allowing forged or tampered identity assertions to be accepted as legitimate. Products embedding affected WebSphere runtimes may also be exposed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows identity impersonation and bypass of authentication and enterprise security controls. Potential consequences include unauthorized manipulation of corporate records and access to private documents. These data-access consequences are conditional assessments rather than established outcomes for every affected deployment.
If you can’t patch tonight, do this now.
IBM states that no vulnerability-specific workarounds or mitigations are available. Restricting network exposure to trusted networks and disabling unnecessary exposed WebSphere services can reduce exposure, but these general precautions are not a substitute for applying PH71422 or a fixed release.
Patch, then assume compromise.
Apply the interim fix for APAR PH71422, first upgrading to the minimum prerequisite fix-pack level required for the installation. Alternatively, install WebSphere Application Server 9.0.5.29 or later, or 8.5.5.30 or later, when available. IBM originally targeted these fix packs for the third quarter of 2026; their release status is not established here. For products embedding WebSphere, follow the applicable product guidance and ensure the underlying runtime receives the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.