CVE-2026-16190 is an authorization bypass vulnerability affecting IBM WebSphere Application Server versions 8.5 and 9.0. The issue is categorized under CWE-862 (Missing Authorization), indicating that the software fails to properly enforce authorization checks. The CVSS v3.1 base score is 3.1, reflecting low impact with attack vector as adjacent network, high attack complexity, no privileges required, and no user interaction. Confidentiality impact is low, with no integrity or availability impact. There is no vendor advisory or patch information available at this time.

An attacker with access to the adjacent network may bypass authorization controls, potentially gaining limited unauthorized access to information. The impact is limited to confidentiality with no reported effects on integrity or availability. No active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor IBM's security advisories for updates. No specific mitigation steps are provided in the available data.