IBM WebSphere Application Server 8.5, 9.0, and the Liberty edition 17.0.0.3 through 26.0.0.7 contain a flaw that permits a remote attacker to bypass configured security constraints, potentially granting unauthorized access or elevated privileges. The vulnerability is mapped to CWE-289, indicating an authentication or authorization bypass weakness. This loss of integrity and confidentiality for protected resources could be exploited to perform actions not intended for the user. While the exact attack vector is not specified in the official description, the vulnerability can be triggered without requiring local access.

Affected systems include IBM WebSphere Application Server versions 8.5.0 through 8.5.5.30, 9.0.0 through 9.0.5.28, and IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7. The documented fix options vary by product and version, with interim fixes for specific APARs (PH71893 for traditional WAS and PH71916 for Liberty) and subsequent fix packs recommended for each combination. Users should consult IBM's support pages to confirm the applicable version and fix path.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of <1% reflects a very low probability of exploitation, although it is not zero. With no inclusion in the CISA KEV catalog, no known public exploits exist. Because the flaw allows a remote attacker to bypass security constraints, an adversary could gain unauthorized access or elevate privileges without local access. Applying the interim fix and then moving to the next available fix pack mitigates the risk, but continuous monitoring for new updates is advisable.