STIGQter: STIG Summary: IBM WebSphere Traditional V9.x Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 01 Apr 2026:

The WebSphere Application Server must be configured to perform complete application deployments when using A/B clusters.

DISA Rule

SV-255881r961122_rule

Vulnerability Number

V-255881

Group Title

SRG-APP-000225-AS-000153

Rule Version

WBSP-AS-001470

Severity

CAT III

CCI(s)

• CCI-001190 - Fail to an organization-defined known-system state for the following failures on the indicated components while preserving organization-defined system state information in failure.

Weight

10

Fix Recommendation

From the administration console, select WebSphere application server clusters.

Select each cluster name.

Select cluster members >> Details.

Set all cluster members configured weight to a non-zero value.

Check Contents

Review System Security Plan documentation to determine if the server is configured to use A/B clusters.

If the System Security Plan does not specify utilizing A/B clusters, the requirement is NA.

From the administration console, select WebSphere application server clusters.

Select each cluster name.

Select cluster members.

If the weight of any cluster member is "0", this is a finding.

Vulnerability Number

V-255881

Documentable

False

Rule Version

WBSP-AS-001470

Severity Override Guidance

Review System Security Plan documentation to determine if the server is configured to use A/B clusters.

If the System Security Plan does not specify utilizing A/B clusters, the requirement is NA.

From the administration console, select WebSphere application server clusters.

Select each cluster name.

Select cluster members.

If the weight of any cluster member is "0", this is a finding.

Check Content Reference

M

Target Key

5510