CVE-2026-10842 describes a security vulnerability in IBM WebSphere Application Server 8.5, 9.0, and Liberty editions from 17.0.0.3 through 26.0.0.7. The vulnerability allows a remote attacker to bypass security constraints, potentially gaining unauthorized access. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity, no privileges, and no user interaction, resulting in high confidentiality impact but no integrity or availability impact. The vulnerability is related to improper authentication (CWE-289). No known exploits in the wild or patch information are currently available.

A remote attacker can bypass security constraints, potentially leading to unauthorized access to sensitive information (high confidentiality impact). There is no reported impact on integrity or availability. This could compromise the confidentiality of data protected by the affected WebSphere Application Server versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's security advisories for updates and consider implementing compensating controls to restrict access until a fix is available.