rootpwn

medium · CVSS v3 5.3

CVE-2026-11539

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to an authentication bypass in the SOAP/JMX connector, allowing attackers to gai

Overview

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to an authentication bypass in the SOAP/JMX connector, allowing attackers to gain unauthorized access to JMX services and potentially expose sensitive configuration data. The flaw is relevant for organizations running these versions in production environments.

Description

IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector.

Impact

Confidentiality: unauthorized disclosure of JMX configuration and management data. Integrity: potential unauthorized changes to application server settings. Availability: possible disruption if attacker modifies services. Impacted parties: system administrators, security teams, and any organization using the affected WebSphere versions.

Remediation

Apply IBM Fix Pack or security patch that addresses the SOAP/JMX authentication bypass. Disable or restrict the SOAP/JMX connector if not required, or block inbound traffic to the JMX port (default 8686) using firewall rules. Verify that authentication is enforced by testing JMX access with valid credentials.

Risk context

The vulnerability is rated medium (CVSS 5.3) and currently has no EPSS score, indicating moderate risk. Organizations should assess exposure promptly but the threat is not considered critical.

Affected products

  • IBM WebSphere Application Server 9.0
  • IBM WebSphere Application Server 8.5

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

authentication-bypass JMX SOAP IBM WebSphere medium server

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-69186

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

View analysis

medium

CVE-2026-71537

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.

View analysis

medium

CVE-2026-77385

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it began with Settings.SafePath before getHash processed it, while transcoder/src/api/streams.go served the accepted path without verifying a Kyoo catalog record. This missing catalog-level authorization allowed the user to retrieve hidden, temporary, operational, or other uncataloged files beneath the media directory when the path was known or guessed. This vulnerability is fixed in 5.1.0.

View analysis