Description
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.
Published: 2026-09-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Log Integrity Compromise (Log Forgery)
Action: Assess Impact
AI Analysis

Impact

IBM WebSphere Application Server versions 8.5 and 9.0 are vulnerable to a log forgery flaw that allows a remote attacker to inject forged entries into the administrative log. This can compromise the integrity of audit trails and obscure malicious activity.

Affected Systems

The flaw affects IBM WebSphere Application Server from version 8.5.0.0 through 8.5.5.30 and from 9.0.0.0 through 9.0.5.28 across all editions. All components of the traditional and WebSphere Application Server for Java environments running those release lines are impacted.

Risk and Exploitability

The CVSS base score of 5.3 indicates a moderate impact. The EPSS score of <1% indicates very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited widespread exploitation. Based on the description, it is inferred that attackers require external network access to the server’s administrative interface to craft forged log entries. While the flaw does not provide direct code execution, it can undermine security through log tampering, so timely patching is recommended.

Generated by OpenCVE AI on September 20, 2026 at 22:25 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by applying the fix pack(s) listed below. For IBM WebSphere Application Server traditional: For V9.0.0.0 through 9.0.5.28: · Apply Fix Pack 9.0.5.29 SB0030823 (availability September 2026) or later fix pack.  For V8.5.0.0 through 8.5.5.30: · Apply Fix Pack 8.5.5.31 https://www.ibm.com/support/pages/node/7285869 (availability September 2026) or later fix pack.

OpenCVE Recommended Actions

  • Apply Fix Pack 9.0.5.29 SB0030823 or later for IBM WebSphere Application Server V9.0, and Apply Fix Pack 8.5.5.31 or later for V8.5, as IBM strongly recommends addressing the vulnerabilities now.
  • Restrict administrative console access to trusted hosts and enforce strong authentication to limit the attack surface while a patch is pending.
  • Monitor administrative logs for anomalous entries and consider forwarding logs to external, immutable storage or audit systems to detect tampering.

Generated by OpenCVE AI on September 20, 2026 at 22:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.
Title IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
First Time appeared Ibm
Ibm websphere Application Server
Weaknesses CWE-117
CPEs cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm websphere Application Server
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Ibm Websphere Application Server
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-14T20:13:30.462Z

Reserved: 2026-07-18T01:50:27.019Z

Link: CVE-2026-16188

cve-icon Vulnrichment

Updated: 2026-09-14T20:13:06.618Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-14T20:16:39.887

Modified: 2026-09-16T19:22:22.797

Link: CVE-2026-16188

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T22:30:06Z

Weaknesses
  • CWE-117

    Improper Output Neutralization for Logs