CVE-2026-9330
Improper Deserialization in IBM WebSphere Application Server
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | websphere_application_server | From 9.0.0.0 (inc) to 9.0.5.28 (inc) |
| ibm | websphere_application_server | From 8.5.0.0 (inc) to 8.5.5.29 (inc) |
| ibm | websphere_application_server | 9.0 |
| ibm | websphere_application_server | 8.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects IBM WebSphere Application Server versions 9.0 and 8.5. It involves improper validation of user-supplied data during deserialization in the SAML Web Single Sign-On component. An attacker can exploit this by sending a specially crafted HTTP request that, when combined with a suitable gadget chain, could lead to remote code execution.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to execute arbitrary code remotely on the affected system. This means the attacker could potentially take control of the server running IBM WebSphere Application Server, leading to data breaches, service disruption, or further attacks within the network.
What immediate steps should I take to mitigate this vulnerability?
IBM recommends applying interim fixes or upgrading to specific fix packs to address the vulnerability in IBM WebSphere Application Server versions 9.0 and 8.5.
- For version 9.0.0.0 through 9.0.5.28, either upgrade to the required fix pack levels and apply the interim fix for APAR PH71453 or apply Fix Pack 9.0.5.29 or later.
- For version 8.5.0.0 through 8.5.5.29, upgrade to the required fix pack levels and apply the interim fix or apply Fix Pack 8.5.5.30 or later.
No workarounds or mitigations are currently available.