CVE-2026-16184 is an authentication bypass in IBM WebSphere versions 8.5 through 9.0, rated CVSS 9.8. The EPSS score of 0.00322 (roughly 0.3% probability of exploitation in 30 days) creates a stark disconnect that requires careful interpretation rather than reflexive patching.
The critical problem with this CVE is the description: 'authentication bypass via crafted unauthenticated request' tells you almost nothing. You cannot build detection rules without understanding what makes the request 'crafted' — whether it's parameter tampering, path manipulation, session fixation, or something else entirely. This is not unusual for IBM middleware vulnerabilities, which historically follow a pattern: maximum severity score, vague mechanism description, low EPSS signal, then targeted exploitation emerges 60-90 days post-disclosure when attackers reverse-engineer the patch.
Given this pattern, treat this as an emergency patch-diff scenario. Obtain the IBM patch, analyze what changed in the authentication flow, and build detection around the actual fix — not the vague CVE description. Waiting for detailed technical writeups is a losing strategy for this vendor-product combination.
The deployment reality matters here. WebSphere typically sits as middleware between front-end applications and backend systems — databases, identity providers, legacy integrations. An authentication bypass here doesn't compromise a single service; it compromises the gateway to a transitive trust network. The blast radius extends into everything WebSphere touches, which in enterprise environments is often extensive.
Your priority actions: first, confirm whether you have exposed WebSphere administrative interfaces — SOAP endpoints, legacy IIOP invocations, or the tibrvJ bridges that linger in older deployments. These are the forgotten interfaces where deprecated authentication handlers survive and where this class of vulnerability typically lives. Second, begin patch planning immediately, but expect regression testing to take 60-90 days given WebSphere's integration complexity — the EPSS window is a poor guide to actual enterprise remediation timelines. Third, in the interim, implement authentication anomaly monitoring on all WebSphere legacy interfaces: focus on authentication state transitions, session token patterns, and unexpected parameter combinations rather than trying to detect an unknown 'crafted' request.
The low EPSS score reflects low probability of mass automated exploitation, not low value as a target. Attackers with network positioning who are already targeting your infrastructure will probe this regardless of EPSS.