Servers and applications
CVE-2016-0306 IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, misconfigures TLS, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
Severity Medium 5.9
Published 17 May 2016
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 1.4% in the next 30 daysHigher than 72% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can Read data
CVSS vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Sources NVD Affected software Software Affected versions IBM WebSphere Application ServerServers and applications · cpe:a:ibm:websphere_application_server Version 8.5.5.9 Version 8.5.5.8 Version 8.5.5.7 Version 8.5.5.6 All 49 release lines Version 7.0.0.0 Version 7.0.0.1 Version 7.0.0.2 Version 7.0.0.3 Version 7.0.0.4 Version 7.0.0.5 Version 7.0.0.7 Version 7.0.0.9 Version 7.0.0.11 Version 7.0.0.13 Version 7.0.0.15 Version 7.0.0.17 Version 7.0.0.19 Version 7.0.0.21 Version 7.0.0.23 Version 7.0.0.25 Version 7.0.0.27 Version 7.0.0.29 Version 7.0.0.31 Version 7.0.0.33 Version 7.0.0.35 Version 7.0.0.37 Version 7.0.0.39 Version 8.0.0.0 Version 8.0.0.1 Version 8.0.0.2 Version 8.0.0.3 Version 8.0.0.4 Version 8.0.0.5 Version 8.0.0.6 Version 8.0.0.7 Version 8.0.0.8 Version 8.0.0.9 Version 8.0.0.10 Version 8.0.0.11 Version 8.0.0.12 Version 8.5.0.0 Version 8.5.0.1 Version 8.5.0.2 Version 8.5.5.0 Version 8.5.5.1 Version 8.5.5.2 Version 8.5.5.3 Version 8.5.5.4 Version 8.5.5.5 Version 8.5.5.6 Version 8.5.5.7 Version 8.5.5.8 Version 8.5.5.9
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-0306 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-0306