CVE-2026-95680

HighCVSS 8.0/10Last modified Oct 14, 2026

Description

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 14, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-956824.8MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name settin CVE-2026-956835.3In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched t CVE-2026-956847.2The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Paramete CVE-2026-956855.3MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of s CVE-2026-956867.2The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to St CVE-2026-956878.8The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions u CVE-2026-956935.3In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(),CVE-2026-956959.1IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to CVE-2026-956967.5IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an CVE-2026-956975.3MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unco CVE-2026-956985.3The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a CVE-2026-956999.6Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can ex