Cyber Resilience

CVE-2026-8644

CriticalUpdated

Published: 01 June 2026

Published
01 June 2026
Modified
17 June 2026
KEV Added
Patch
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0032 23.6th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-8644 is a critical-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Ibm Websphere Application Server. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CWE-290 identity spoofing vuln in public-facing WebSphere server directly enables T1190 exploitation for unauthorized access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-9311Same product: Ibm Websphere Application Server
CVE-2026-8633Same product: Ibm Websphere Application Server
CVE-2026-9330Same product: Ibm Websphere Application Server
CVE-2026-9319Same product: Ibm Websphere Application Server
CVE-2025-14914Same product: Ibm Websphere Application Server
CVE-2026-8620Same product: Ibm Websphere Application Server
CVE-2026-3621Same product: Ibm Websphere Application Server
CVE-2025-14923Same product: Ibm Websphere Application Server
CVE-2025-0159Same vendor: Ibm
CVE-2025-0160Same vendor: Ibm

Affected Assets

ibm
websphere application server
8.5.0.0 — 8.5.5.30 · 9.0.0.0 — 9.0.5.29

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-290

Reveals spoofed logon attempts through unexpected previous logon timestamps upon legitimate login.

addresses: CWE-290

Training specifically addresses recognizing spoofed communications and phishing that enable authentication bypass.

addresses: CWE-290

Requiring verifiable identity evidence at appropriate assurance levels makes it substantially harder for attackers to successfully spoof or impersonate users to obtain accounts.

addresses: CWE-290

Unique device authentication makes successful spoofing of device identity substantially more difficult to achieve.

addresses: CWE-290

Unique identification of non-organizational users reduces the feasibility of authentication bypass by spoofing.

addresses: CWE-290

Unique identification and authentication of services before communications makes spoofing of service identities substantially harder.

addresses: CWE-290

Isolated trusted path ensures the user interacts only with genuine system components, preventing spoofing of authentication interfaces or prompts.

addresses: CWE-290

Directly counters DNS response spoofing by requiring cryptographic origin authentication artifacts from the authoritative source.

References