CVE-2026-9311: IBM WebSphere Application Server is affected by remote code execution

Synopsis

A remote code execution vulnerability affects IBM WebSphere Application Server versions 9.0 and 8.5, caused by a bypass of security controls. The flaw is reachable over the network without any authentication, though exploitation requires overcoming environmental conditions that raise attack complexity. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected server, including the ability to execute arbitrary code. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment IBM publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebSphere Application Server service over the network; the service must be exposed to the attacker's network segment.

• AuthenticationNot required

  No account or credentials are needed; the attacker can target the service as an unauthenticated external party.

• Victim interactionNot required

  No user action or interaction from anyone on the target system is required for the attack to succeed.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must account for race conditions, specific memory layout, or other environmental factors that cannot be reliably controlled on every attempt.

Blast Radius

• Reads any data accessible to the WebSphere process, including session tokens, application credentials, and business records stored or cached by the server.
• Modifies or deletes application data, configuration files, and persisted state managed by the affected WebSphere instance.
• Crashes or degrades the WebSphere Application Server process, causing a full service outage for applications hosted on it.
• Because the scope is changed (S:C), the attacker can pivot beyond the WebSphere process boundary and affect other components or services sharing the same host or infrastructure.