Vulnerability-Lookup

CNVD-2026-19182

Vulnerability from cnvd - Published: 2026-05-06

Title

IBM WebSphere Application Server安全特征问题漏洞（CNVD-2026-19182）

Description

IBM WebSphere Application Server（WAS）是美国国际商业机器（IBM）公司的一款应用服务器产品。该产品是JavaEE和Web服务应用程序的平台，也是IBMWebSphere软件平台的基础。 IBM WebSphere Application Server（WAS）存在安全特征问题漏洞，该漏洞源于安全设置的系统管理期间可能提供弱于预期的安全性。攻击者可利用该漏洞通过特定手段突破系统防护。

Severity

中

Patch Name

IBM WebSphere Application Server安全特征问题漏洞（CNVD-2026-19182）的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://www.ibm.com/support/pages/node/7260217

Reference

https://nvd.nist.gov/vuln/detail/CVE-2025-13333

Impacted products

Name
['IBM WebSphere Application Server 9.0.0.0', 'IBM WebSphere Application Server 8.5.0.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-13333",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-13333"
    }
  },
  "description": "IBM WebSphere Application Server\uff08WAS\uff09\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u5e94\u7528\u670d\u52a1\u5668\u4ea7\u54c1\u3002\u8be5\u4ea7\u54c1\u662fJavaEE\u548cWeb\u670d\u52a1\u5e94\u7528\u7a0b\u5e8f\u7684\u5e73\u53f0\uff0c\u4e5f\u662fIBMWebSphere\u8f6f\u4ef6\u5e73\u53f0\u7684\u57fa\u7840\u3002\n\nIBM WebSphere Application Server\uff08WAS\uff09\u5b58\u5728\u5b89\u5168\u7279\u5f81\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5b89\u5168\u8bbe\u7f6e\u7684\u7cfb\u7edf\u7ba1\u7406\u671f\u95f4\u53ef\u80fd\u63d0\u4f9b\u5f31\u4e8e\u9884\u671f\u7684\u5b89\u5168\u6027\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7279\u5b9a\u624b\u6bb5\u7a81\u7834\u7cfb\u7edf\u9632\u62a4\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a \r\nhttps://www.ibm.com/support/pages/node/7260217",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-19182",
  "openTime": "2026-05-06",
  "patchDescription": "IBM WebSphere Application Server\uff08WAS\uff09\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u5e94\u7528\u670d\u52a1\u5668\u4ea7\u54c1\u3002\u8be5\u4ea7\u54c1\u662fJavaEE\u548cWeb\u670d\u52a1\u5e94\u7528\u7a0b\u5e8f\u7684\u5e73\u53f0\uff0c\u4e5f\u662fIBMWebSphere\u8f6f\u4ef6\u5e73\u53f0\u7684\u57fa\u7840\u3002\r\n\r\nIBM WebSphere Application Server\uff08WAS\uff09\u5b58\u5728\u5b89\u5168\u7279\u5f81\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5b89\u5168\u8bbe\u7f6e\u7684\u7cfb\u7edf\u7ba1\u7406\u671f\u95f4\u53ef\u80fd\u63d0\u4f9b\u5f31\u4e8e\u9884\u671f\u7684\u5b89\u5168\u6027\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7279\u5b9a\u624b\u6bb5\u7a81\u7834\u7cfb\u7edf\u9632\u62a4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM WebSphere Application Server\u5b89\u5168\u7279\u5f81\u95ee\u9898\u6f0f\u6d1e\uff08CNVD-2026-19182\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM WebSphere Application Server 9.0.0.0",
      "IBM WebSphere Application Server 8.5.0.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2025-13333",
  "serverity": "\u4e2d",
  "submitTime": "2026-03-17",
  "title": "IBM WebSphere Application Server\u5b89\u5168\u7279\u5f81\u95ee\u9898\u6f0f\u6d1e\uff08CNVD-2026-19182\uff09"
}

CVE-2025-13333 (GCVE-0-2025-13333)

Vulnerability from cvelistv5 – Published: 2026-02-17 22:45 – Updated: 2026-02-18 20:41

Title

IBM WebSphere Application Server could provide weaker than expected security

Summary

IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-18 20:41 UTC

CWE

CWE-358 - Improperly Implemented Security Check for Standard

Assigner

ibm mitre root

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7260217	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	WebSphere Application Server	Affected: 9.0 , ≤ 9.0.5.27 (semver) Affected: 8.5 , ≤ 8.5.5.29 (semver) cpe:2.3:a:ibm:websphere_application_server:9.0:::::::* cpe:2.3:a:ibm:websphere_application_server:9.0.0:::::::* cpe:2.3:a:ibm:websphere_application_server:8.5:::::::* cpe:2.3:a:ibm:websphere_application_server:8.5.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13333",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-18T20:41:47.988272Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-18T20:41:58.252Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*"
          ],
          "product": "WebSphere Application Server",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "9.0.5.27",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.5.29",
              "status": "affected",
              "version": "8.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings.\u003c/p\u003e"
            }
          ],
          "value": "IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-358",
              "description": "CWE-358 Improperly Implemented Security Check for Standard",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-17T22:45:10.891Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7260217"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH68976.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eAttention: After installing the interim fix or fixpack, please follow the additional instructions provided in the interim fix link referenced below to complete the remediation.\u003c/strong\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eFor IBM WebSphere Application Server traditional:\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eFor V9.0.0.0 through 9.0.5.26:\u003c/strong\u003e\u003cbr\u003e\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7260117\"\u003ePH68976\u003c/a\u003e\u0026nbsp;and \u003cstrong\u003ecarefully follow the instructions for steps required after fix installation.\u003c/strong\u003e\u003cbr\u003e--OR--\u003cbr\u003e\u00b7 Apply Fix Pack 9.0.5.27 or later (targeted availability 1Q2026) and \u003cstrong\u003ecarefully follow the instructions in \u003c/strong\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7260117\"\u003ePH68976\u003c/a\u003e\u003cstrong\u003e\u0026nbsp;for steps required after fixpack installation.\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eFor V8.5.0.0 through 8.5.5.29:\u003c/strong\u003e\u003cbr\u003e\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7260117\"\u003ePH68976\u003c/a\u003e\u0026nbsp;and \u003cstrong\u003ecarefully follow the instructions for steps required after fix installation.\u003c/strong\u003e\u003cbr\u003e--OR--\u003cbr\u003e\u00b7 Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026) and \u003cstrong\u003ecarefully follow the instructions in \u003c/strong\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7260117\"\u003ePH68976\u003c/a\u003e\u003cstrong\u003e\u0026nbsp;for steps required after fixpack installation.\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eAdditional interim fixes may be available and linked off the interim fix download page.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH68976.\n\nAttention: After installing the interim fix or fixpack, please follow the additional instructions provided in the interim fix link referenced below to complete the remediation.\u00a0\n\nFor IBM WebSphere Application Server traditional:\n\nFor V9.0.0.0 through 9.0.5.26:\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves  PH68976 https://www.ibm.com/support/pages/node/7260117 \u00a0and carefully follow the instructions for steps required after fix installation.\n--OR--\n\u00b7 Apply Fix Pack 9.0.5.27 or later (targeted availability 1Q2026) and carefully follow the instructions in  PH68976 https://www.ibm.com/support/pages/node/7260117 \u00a0for steps required after fixpack installation.\n\nFor V8.5.0.0 through 8.5.5.29:\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves  PH68976 https://www.ibm.com/support/pages/node/7260117 \u00a0and carefully follow the instructions for steps required after fix installation.\n--OR--\n\u00b7 Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026) and carefully follow the instructions in  PH68976 https://www.ibm.com/support/pages/node/7260117 \u00a0for steps required after fixpack installation.\n\nAdditional interim fixes may be available and linked off the interim fix download page."
        }
      ],
      "title": "IBM WebSphere Application Server could provide weaker than expected security",
      "x_generator": {
        "engine": "ibm-cvegen"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-13333",
    "datePublished": "2026-02-17T22:45:10.891Z",
    "dateReserved": "2025-11-17T19:53:28.144Z",
    "dateUpdated": "2026-02-18T20:41:58.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.