CVE-2026-16185 describes an authentication bypass vulnerability in IBM WebSphere Application Server versions 9.0 and 8.5. A remote attacker could exploit this flaw to bypass authentication controls on an admin console servlet, potentially gaining unauthorized access. The CVSS 3.1 vector indicates the attack requires adjacent network access (AV:A), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), with low confidentiality and integrity impact but high availability impact.

Successful exploitation could allow an attacker to bypass authentication on the admin console servlet, potentially leading to unauthorized administrative access. This could compromise system availability and cause limited confidentiality and integrity impacts as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Administrators should monitor IBM's security advisories for updates and apply any official patches or mitigations once available.