CVE-2026-9327 is a medium severity (6.3) improper privilege management flaw in IBM WebSphere Application Server 9.0 and 8.5. An authenticated user with a low-privilege administrative role can modify security configuration. The fix is Fix Pack 9.0.5.29 for 9.0 and 8.5.5.31 for 8.5.
What's affected
IBM's bulletin, published 8 September 2026, lists WebSphere Application Server 9.0 and 8.5 as affected, specifically 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.30. It says to apply Fix Pack 9.0.5.29 or 8.5.5.31, or a later fix pack, and describes their availability as September 2026. The bulletin lists no workarounds or mitigations. It covers several CVEs at once, so one fix pack closes all of them.
The weakness is CWE-269, improper privilege management. Both the record and the bulletin give a score of 6.3 and the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H. IBM says the result could be information disclosure or denial of service. The vector shows a changed scope, meaning the effect reaches past the component the attacker started in.
How to check if you're exposed
On the server, run the version tool from the product's bin directory:
./versionInfo.sh
The output lists the installed product and fix pack level. Compare it with 9.0.5.29 on the 9.0 line and 8.5.5.31 on the 8.5 line. Anything lower is in scope.
Inventory every WebSphere installation, including older test servers and ones managed by other teams. Note that the bulletin only covers supported versions, and says that leaving an unsupported version off its list is not a statement that it is unaffected.
Also review your WebSphere administrative role assignments. This flaw requires an account that already holds some administrative role, so a short list of such accounts reduces who could use it.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Plan and apply Fix Pack 9.0.5.29 or 8.5.5.31 (or later) following IBM's fix pack instructions, starting with internet-facing and production servers.
- Test the fix pack on a staging server first, since it is a cumulative update.
- Record the fix pack level for each server after patching.
- Subscribe to IBM's security bulletin notifications for WebSphere so the next one reaches you on the day it is published.
- Review who holds administrative roles in the WebSphere console and remove roles that are not needed.
Why it matters
Administrative roles in an application server are meant to be tiered, so that someone allowed to do a little cannot do everything. Improper privilege management means a role could do more than its name implies. IBM states that a user with a low-privilege administrative role could modify security configuration, which belongs to a higher tier.
The attack is network reachable and needs a login, but the high complexity rating and the need for an existing administrative role keep the score at medium. Security settings are valuable to change, because altering them can weaken protections for everything else. The KEV flag in the record is false and the bulletin does not report exploitation.
Quick check
Does an attacker need an account?
Yes. The vector requires low privileges, and the description says an authenticated user with a low-privilege administrative role.
Is this the same fix as for CVE-2026-9176?
The IBM bulletin covers both, and the same fix packs apply.
Sources
Last reviewed: 18 October 2026.
