CVE-2026-9330: IBM WebSphere Application Server is affected by remote code execution

Synopsis

A deserialization vulnerability in IBM WebSphere Application Server's SAML Web Single Sign-On component allows a network-accessible attacker with low-privilege credentials to execute arbitrary code on the server. The flaw stems from improper validation of user-supplied data during deserialization; an attacker sends a crafted HTTP request paired with a suitable gadget chain to trigger the exploit. Successful exploitation grants full remote code execution with high impact on confidentiality, integrity, and availability across the affected system and potentially adjacent systems in scope. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment IBM ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WebSphere Application Server over the network, as the SAML SSO endpoint is exposed via HTTP.

• AuthenticationRequired

  The attacker must hold at least a low-privilege account, since the CVSS vector specifies PR:L; any valid low-privilege credential is sufficient.

• Victim interactionNot required

  No victim interaction is needed; the attacker triggers the vulnerability directly through a crafted HTTP request without requiring any user action.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must assemble a working gadget chain and may depend on specific environmental conditions or classpath contents to achieve code execution reliably.

Blast Radius

• A successful attacker executes arbitrary code in the context of the WebSphere server process, gaining full control over the application runtime.
• Because the CVSS scope is Changed, the attacker can pivot beyond the vulnerable component and access resources in other system scopes or containers sharing the environment.
• All data processed or stored by the application server, including session tokens, credentials, and customer records, is readable by the attacker (Confidentiality: High).
• The attacker can modify application data, alter persisted records, or overwrite configuration, and can crash or render the service completely unavailable (Integrity and Availability: High).