IBM WebSphere Application Server 8.5 and 9.0 contain a broken access control flaw in the administrative console that permits an attacker to elevate privileges. The vulnerability is classified as CWE‑306, and if exploited, an attacker could gain full administrative rights, allowing arbitrary configuration changes, code deployment, and potential control of the entire application server instance. This can compromise confidentiality, integrity, and availability of services running on the affected server.

The flaw impacts IBM WebSphere Application Server version 8.5 for all sub‑versions up to 8.5.5.30 and version 9.0 up to 9.0.5.28. Microsoft‑style patch numbering is used, and users should refer to IBM’s fix pack or interim fix DT496500 to remediate the vulnerability.

The CVSS score of 9.8 classifies this as a critical risk, but the EPSS score is below 1 %, suggesting a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker with access to the administrative console—potentially a user with limited privileges—could exploit this weakness to perform privilege escalation. The impact is system‑wide if administrative control is achieved. Applying the specified interim fix or upgrading to the relevant higher‑level fix pack will eliminate the risk.