CVE-2026-8644: IBM WebSphere Application Server is affected by an identity spoofing vulnerability

Synopsis

Identity spoofing vulnerability in IBM WebSphere Application Server 9.0 and 8.5 allows a remote, unauthenticated attacker to impersonate arbitrary identities. The vulnerability is reachable over the network with no credentials required and no victim interaction needed, making it trivially exploitable from any internet-accessible host. Successful exploitation gives the attacker the ability to manipulate server-side data and disrupt service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment IBM publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WebSphere Application Server over the network; any internet-accessible or internally routable instance is exposed.

• AuthenticationNot required

  No credentials or existing account are needed; the attacker can trigger the vulnerability as an anonymous, unauthenticated caller.

• Victim interactionNot required

  No user action is required; the attacker exploits the vulnerability directly against the server without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites.

Blast Radius

• Attacker impersonates arbitrary user identities, bypassing access controls on protected server resources.
• Attacker modifies application state, configuration data, or persisted records accessible under spoofed identities.
• Attacker disrupts service availability, causing the affected WebSphere instance to become unresponsive or crash.
• Any workload or backend system that trusts identity assertions from the affected WebSphere instance is transitively exposed to unauthorized access.