CVE-2026-8644 is an authentication bypass vulnerability classified under CWE-290 affecting IBM WebSphere Application Server versions 8.5 and 9.0. The vulnerability allows an attacker to spoof identities, bypassing authentication mechanisms without requiring privileges or user interaction. The CVSS 3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on integrity and availability. No official remediation or patch has been published by IBM as of the provided data.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass authentication controls, potentially leading to unauthorized actions that compromise the integrity and availability of the affected system. Confidentiality impact is not indicated. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor IBM advisories closely for updates. Until a patch is available, consider implementing compensating controls such as enhanced network segmentation or access restrictions to the affected WebSphere Application Server instances.