CVE-2026-9319: IBM WebSphere Application Server is affected by a remote code execution vulnerability

Synopsis

A remote code execution vulnerability affects IBM WebSphere Application Server versions 9.0 and 8.5, triggered through deserialization of untrusted data sent to JAX-WS endpoints that use WS-Security. The vulnerability is reachable over the network without any authentication, though exploitation requires overcoming high-complexity conditions. Successful exploitation gives an attacker full control over the host, including the ability to read, modify, or destroy data and crash the service. HarborGuard is tracking the advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable JAX-WS endpoint must be reachable over the network, exposing the attack surface to any host that can send HTTP or SOAP traffic to the server.

• AuthenticationNot required

  No credentials or session token are needed; an unauthenticated attacker can send a crafted payload directly to the endpoint.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any user or administrator of the affected system.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for specific environmental conditions such as timing, memory layout, or particular server configuration before the deserialization payload executes reliably.

Blast Radius

• A successful attacker executes arbitrary code in the context of the WebSphere Application Server process, gaining full control of the host.
• Confidential data accessible to the server process, including credentials, session tokens, and business records, can be read and exfiltrated.
• Persistent application data and configuration files stored on the host can be modified or deleted.
• The WebSphere Application Server process and any dependent services can be terminated, causing a full service outage.