IBM WebSphere Application Server versions 8.5 and 9.0, as well as Liberty versions from 17.0.0.3 through 26.0.0.7, contain an authentication bypass vulnerability identified as CVE-2026-10842. This vulnerability allows a remote attacker to bypass security constraints, potentially gaining unauthorized access to protected resources. The issue is categorized under CWE-289, indicating an authentication bypass by alternate name. The CVSS v3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, while integrity and availability impacts are none. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

A remote attacker can bypass authentication mechanisms in affected IBM WebSphere Application Server versions, potentially gaining unauthorized access to sensitive information or resources. The confidentiality impact is high, meaning sensitive data could be exposed. There is no impact on integrity or availability according to the CVSS vector. This could lead to unauthorized data disclosure without requiring user interaction or privileges.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, monitor IBM's security advisories for updates. No temporary or official fixes are currently documented.