IBM WebSphere Application Server 8.5 and 9.0 contain a flaw that allows a remote attacker to bypass authentication controls and gain unauthorized access to JAX‑WS applications. The vulnerability does not require local access, and it enables the attacker to invoke application functionality without valid credentials.

The affected products are IBM WebSphere Application Server 8.5 and 9.0. Specific vulnerable versions are V8.5.0.0 through V8.5.5.29 for 8.5 and V9.0.0.0 through V9.0.5.28 for 9.0. IBM recommends applying the interim fix for APAR PH71648 or upgrading to Fix Pack 8.5.5.30 or later for 8.5, and Fix Pack 9.0.5.29 or later for 9.0.

The flaw can be exploited remotely; an attacker need not have local access. Because the vulnerability allows bypass of authentication, the potential impact is high regarding unauthorized operation of JAX‑WS services. No EPSS score is provided, and the issue is not listed in CISA KEV. The escalation of risk is based solely on the inability to authenticate to protected application resources. The CVSS score is 7.3, indicating high severity.