CVE-2026-9176 is a medium severity (6.7) security bypass in IBM WebSphere Application Server 9.0 and 8.5. IBM says improper authentication controls let a local attacker escalate privileges and reach protected resources. The fix is Fix Pack 9.0.5.29 for 9.0 and Fix Pack 8.5.5.31 for 8.5.
What's affected
IBM's bulletin, published 8 September 2026, lists WebSphere Application Server 9.0 and 8.5 as affected, specifically 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.30. It says to apply Fix Pack 9.0.5.29 or 8.5.5.31, or a later fix pack, and describes their availability as September 2026. The bulletin lists no workarounds or mitigations. It covers several CVEs at once, so one fix pack closes all of them.
The record and the bulletin agree on the score of 6.7 and on the vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N: a local attacker, a hard-to-meet condition, and high confidentiality and integrity impact. Both list the weakness as CWE-94, code injection. The description itself speaks of improper authentication controls, so the label and the wording do not line up neatly. IBM's text is the one to go by.
How to check if you're exposed
On the server, run the version tool from the product's bin directory:
./versionInfo.sh
The output lists the installed product and fix pack level. Compare it with 9.0.5.29 on the 9.0 line and 8.5.5.31 on the 8.5 line. Anything lower is in scope.
Inventory every WebSphere installation, including older test servers and ones managed by other teams. Note that the bulletin only covers supported versions, and says that leaving an unsupported version off its list is not a statement that it is unaffected.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Plan and apply Fix Pack 9.0.5.29 or 8.5.5.31 (or later) following IBM's fix pack instructions, starting with internet-facing and production servers.
- Test the fix pack on a staging server first, since it is a cumulative update.
- Record the fix pack level for each server after patching.
- Subscribe to IBM's security bulletin notifications for WebSphere so the next one reaches you on the day it is published.
Why it matters
IBM keeps the description short, so we cannot say more about the mechanism than the bulletin does. What it tells us is the shape of the risk: someone who already has local access to the host can get past a security check and gain access they were not granted.
Local flaws like this matter most on shared servers, where a low-privilege account or a foothold from a different bug is the starting point. The attacker needs no extra privileges for this one according to the vector, but the high complexity rating means conditions must line up. The KEV flag in the record is false and the bulletin does not report exploitation.
Quick check
Which fix packs close this?
Fix Pack 9.0.5.29 for the 9.0 line and Fix Pack 8.5.5.31 for the 8.5 line, or any later fix pack.
Is there a workaround?
The bulletin lists none.
Sources
Last reviewed: 18 October 2026.
