CVE-2016-2945: IBM WebSphere Application Server

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

The API Discovery implementation in IBM WebSphere Application Server (WAS) 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document.

Affected products

• IBM WebSphere Application Server: version 8.5.5.8 only; version 8.5.5.9 only

Published 2016-07-08. Last modified 2026-06-17.