CVE-2026-16184 is an authentication bypass in IBM WebSphere Application Server traditional versions 8.5 and 9.0, rated 7.0 (high). IBM says a remote attacker could bypass authentication by sending a crafted unauthenticated request. The remedy is the interim fix for APAR DT496677, or fix pack 9.0.5.29 or 8.5.5.31 when available.
What's affected
- Product: IBM WebSphere Application Server traditional, versions 8.5 and 9.0.
- Fix: the interim fix for APAR DT496677, applied after the minimum fix pack level it requires.
- Fix packs: 9.0.5.29 or later for V9.0.0.0 through 9.0.5.28, and 8.5.5.31 or later for V8.5.0.0 through 8.5.5.30, both targeted for the third quarter of 2026 in IBM's bulletin.
- Severity: 7.0 with the record's CWE-862 (missing authorization). The vector uses network access, no privileges and no user interaction, with high attack complexity. Not on the CISA Known Exploited Vulnerabilities list.
- Workarounds: IBM lists none.
How to check if you're exposed
Check the installed version and applied interim fixes on each traditional WebSphere node:
<was_root>/bin/versionInfo.sh
Look for DT496677 in the list of fixes, and for the fix pack level. Compare with the ranges above. Do this on every node of every cell, including standby and disaster recovery environments, which are often patched last.
Then think about reach. Identify which application servers can be reached directly by users or by systems outside your trusted network. List the applications on them that rely on WebSphere's own security to protect URLs or resources. Those are the ones where an authentication bypass changes the outcome.
Check access logs for unauthenticated requests that returned successful responses on pages that should require a login. Such entries can be normal, for example public pages, so compare against what you expect rather than treating every one as an alert.
What to do now
- List all traditional WebSphere servers on 8.5 and 9.0 with their fix pack and interim fix levels.
- Apply the interim fix for DT496677, after bringing each server up to the minimum fix pack level IBM requires.
- Plan the move to 9.0.5.29 or 8.5.5.31 when the fix packs are available.
- Put a gateway or reverse proxy in front of exposed servers that enforces its own authentication on sensitive paths.
- Review logs for unauthenticated successful requests to protected resources in the period before the fix.
- Ask IBM support if you cannot tell which interim fix applies to your fix pack level, and keep the case number with the change record.
Why it matters
An authentication bypass means the front door check can be skipped. The record classifies this as CWE-862, missing authorization: the system performs an action without confirming that the requester is allowed to ask for it. IBM describes it simply as a bypass reached by a crafted request that carries no credentials.
The 7.0 score is the product of two opposing facts. In the favor of the attacker, the vector asks for nothing: no privileges, no user interaction, and network access. Against them, the attack complexity is high, which suggests that special conditions are needed. IBM does not say what they are. A reasonable reading is that this is serious for exposed servers and lower for those behind other controls, which is where the order of your work should come from.
Authentication flaws deserve extra care because they undermine the assumptions of everything behind them. An application may have careful role checks, but those checks assume that the container has already established who is calling. If the container can be bypassed, the application's own checks may never run, or may run against an empty identity.
Defense in depth helps here, and it is not exotic. A gateway that authenticates requests before they reach the application server, network rules that limit who can connect, and application level checks on sensitive actions all reduce the value of a single bypass. Apply the fix, and review those layers while the maintenance window is open.
Quick check
Does the bulletin say exploitation is happening?
The bulletin does not report exploitation, and the record is not on the CISA Known Exploited Vulnerabilities list.
Does this affect Liberty?
The bulletin and record list WebSphere Application Server 9.0 and 8.5. Liberty is not listed for this CVE.
Sources
Last reviewed: 19 October 2026.
