Introduction
An unauthenticated remote attacker can spoof identities on IBM WebSphere Application Server traditional 8.5 and 9.0 with no user interaction, no privileges, and low attack complexity. That combination gives the vulnerability a CVSS score of 9.1. IBM has confirmed that no workarounds or mitigations exist, and formal fix packs are not expected until the third quarter of 2026. Until then, an interim fix is the only remediation path, and organizations face a multi-month exposure window.
Technical Information
Root Cause: Improper Signature Validation and CWE-290
CVE-2026-8644 is classified under CWE-290: Authentication Bypass by Spoofing, which MITRE defines as a weakness caused by "incorrectly implemented authentication schemes that are subject to spoofing attacks." The IBM Master Data Management security advisory is more specific about the root cause and describes the issue as "identity spoofing by an authenticated user due to improper signature validation." This strongly suggests that the WebSphere traditional server does not properly validate authentication tokens, credentials, or security signatures. If so, an attacker can forge or tamper with identity assertions that the server then accepts as legitimate.
CVSS Vector Analysis
The full CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Each metric breaks down as follows:
| CVSS Metric | Value | Implication |
|---|---|---|
| Attack Vector (AV) | Network | Exploitable remotely over the network |
| Attack Complexity (AC) | Low | Minimal technical skill required |
| Privileges Required (PR) | None | No authentication needed to exploit |
| User Interaction (UI) | None | No victim action required |
| Scope (S) | Unchanged | Impact confined to the vulnerable component |
| Confidentiality (C) | None | No direct information disclosure |
| Integrity (I) | High | Complete loss of integrity protection |
| Availability (A) | High | Complete loss of availability |
The vector rates confidentiality impact as none but integrity and availability impact as high. That pattern suggests the vulnerability lets an attacker assume another identity and possibly disrupt service, rather than exfiltrate data directly. Identity spoofing still undermines access controls, though. An attacker who impersonates a privileged user could reach confidential resources indirectly through the spoofed identity.
Attack Patterns Associated with CWE-290
MITRE documents several concrete attack patterns under CWE-290:
- Exploitation of Trusted Identifiers: An attacker forges or manipulates a trusted identifier that the authentication system relies on (such as an IP address, hostname, or certificate) to gain trusted status.
- Signature Spoofing by Misrepresentation (CAPEC-476): An attacker exploits weaknesses in parsing or display code to generate a data blob containing a supposedly valid signature, so the recipient accepts falsified authentication data.
- Adversary in the Middle (AiTM): An attacker sits between communicating parties to intercept and manipulate authentication exchanges.
MITRE's observed examples of CWE-290 include CVE-2022-30319, where an attacker bypassed an IP allowlist in a home automation product with a forged IP address, and CVE-2009-1048, where a VOIP product allowed authentication bypass when the Host header contained 127.0.0.1.
Comparison with CVE-2026-3621 (WebSphere Liberty)
CVE-2026-3621, a closely related vulnerability disclosed on April 22, 2026, affects IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.4. Setting the two side by side shows how severe CVE-2026-8644 is:
| Dimension | CVE-2026-8644 (WAS Traditional) | CVE-2026-3621 (WAS Liberty) |
|---|---|---|
| CVSS Score | 9.1 (Critical) | 5.4 (Medium) |
| Privileges Required | None | None (but configuration dependent) |
| Exploitation Condition | Default configuration | appSecurity feature disabled |
| Workaround Available | No | Yes (enable appSecurity) |
| Root Cause Hint | Improper signature validation | Missing appSecurity feature |
The Liberty variant scores lower because it is exploitable only when the appSecurity feature is not enabled, which limits exploitation to misconfigured deployments. IBM's advisory states that the Liberty vulnerability "occurs under limited conditions when an application is deployed without authentication and authorization configured." For CVE-2026-3621, IBM provides a workaround: enable one of the appSecurity features (appSecurity-1.0 through appSecurity-5.0).
CVE-2026-8644 has no such configuration toggle. That difference shows the traditional WebSphere authentication implementation has a deeper, more fundamental flaw than the Liberty one. The traditional variant's vulnerability appears to be rooted in improper signature validation within the core authentication mechanism itself.
Downstream Product Exposure
IBM Master Data Management versions 11.6 and 12.0 are confirmed to be affected by the same class of WebSphere identity spoofing vulnerability. Organizations running IBM products that embed WebSphere as a runtime component carry transitive risk beyond their standalone WAS deployments. IBM has stated that over 150 IBM products ship with Liberty or WebSphere as their internal application server, so the blast radius extends well beyond direct WebSphere installations.
In April 2026, security research firm Oligo also disclosed a pre-authentication arbitrary class deserialization vulnerability in the SAML Web SSO component of WebSphere Liberty. It is further evidence of systemic weaknesses in the authentication layer across the WebSphere family.
Mitigation Strategies
IBM states: "There are no known workarounds or mitigations for this vulnerability." The only remediation path is the interim fix for APAR PH71422.
For V9.0.0.0 through 9.0.5.28: Upgrade to the minimal fix pack levels required by the interim fix, then apply the Interim Fix that resolves PH71422. Alternatively, apply Fix Pack 9.0.5.29 or later (targeted for 3Q2026).
For V8.5.0.0 through 8.5.5.29: Upgrade to the minimal fix pack levels required by the interim fix, then apply the Interim Fix for PH71422. Alternatively, apply Fix Pack 8.5.5.30 or later (targeted for 3Q2026).
IBM offers no official workarounds, but organizations waiting to deploy the interim fix may consider the defensive measures below. IBM does not endorse them, and they are not equivalent to applying the patch.
- Network access restrictions: Limit network exposure of WebSphere Application Server administration and application endpoints to trusted internal networks only. This reduces the attack surface available through the network-based attack vector.
- WAF rules: Deploy web application firewall rules to detect and block potential authentication spoofing attempts. Their effectiveness against this specific vulnerability is unconfirmed.
- Enhanced monitoring: Enable verbose authentication logging and configure SIEM alerts for anomalous identity assertions, authentication events from unexpected sources, or privilege escalation patterns.
- Downstream product audit: Identify and patch IBM products that embed WebSphere as a runtime component. IBM Master Data Management 11.6 and 12.0 are confirmed affected, and other IBM products that ship with WebSphere traditional should be assessed.
Affected Systems and Versions
The following IBM WebSphere Application Server traditional versions are affected:
- WebSphere Application Server 9.0: Versions 9.0.0.0 through 9.0.5.28
- WebSphere Application Server 8.5: Versions 8.5.0.0 through 8.5.5.29
Downstream products confirmed affected by the same class of vulnerability:
- IBM Master Data Management 11.6
- IBM Master Data Management 12.0
Together, the affected ranges (8.5.0.0 through 8.5.5.29 and 9.0.0.0 through 9.0.5.28) cover years of production deployments. IBM has confirmed there is no planned end-of-support date for WebSphere 8.5.5 and 9.0.5, so these codebases will stay in production for the foreseeable future.
Vendor Security History
IBM WebSphere Application Server has had a steady stream of security vulnerabilities in recent years, and identity spoofing has come up more than once:
| CVE | Date | Type | CVSS | Affected Product |
|---|---|---|---|---|
| CVE-2026-8644 | Jun 2026 | Identity Spoofing (CWE-290) | 9.1 | WAS traditional 8.5, 9.0 |
| CVE-2026-3621 | Apr 2026 | Identity Spoofing (CWE-290) | 5.4 | WAS Liberty 17.0.0.3 through 26.0.0.4 |
| CVE-2026-1188 | 2026 | Security vulnerability | Reported | WAS shipped with IBM DevOps Code ClearCase |
| CVE-2026-8633 | 2026 | Vulnerability in plug ins | Reported | IBM Web Server Plug ins for WAS |
| CVE-2025-36038 | Jun 2025 | Arbitrary Code Execution | Reported | WAS |
| CVE-2025-36099 | Sep 2025 | Vulnerability | Reported | WAS Liberty |
| CVE-2025-14915 | 2025 | Privilege Escalation | 0.3 | WAS Liberty |
IBM disclosed two identity spoofing vulnerabilities within two months of each other (CVE-2026-3621 in April and CVE-2026-8644 in June), one in the traditional variant and one in Liberty. That suggests a systemic weakness in IBM's authentication and signature validation implementations across the WebSphere product family. A pattern like this warrants a comprehensive, product-wide security review rather than isolated point fixes.
References
- NVD: CVE-2026-8644
- IBM Security Bulletin: IBM WebSphere Application Server is affected by an identity spoofing vulnerability (CVE-2026-8644)
- IBM Security Bulletin: IBM WebSphere Application Server Liberty is affected by identity spoofing (CVE-2026-3621)
- IBM Security Bulletin: IBM Master Data Management is vulnerable to identity spoofing
- NVD: CVE-2026-3621
- CWE-290: Authentication Bypass by Spoofing
- CAPEC-476: Signature Spoofing by Misrepresentation
- IBM WebSphere Application Server and IBM HTTP Server Security Bulletin List
- IBM Security Bulletin: WebSphere Application Server affected by arbitrary code execution (CVE-2025-36038)
- Oligo Security: New Vulnerabilities in IBM WebSphere Liberty
- IBM WebSphere Application Server Support Announcement
- Vulnerability Intelligence Report, May 29, 2026
