CVE-2026-15887
Received Received - Intake

Blind SSRF in IBM WebSphere Application Server

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description
IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-15887

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ibm websphere_application_server 9.0
ibm websphere_application_server 8.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM WebSphere Application Server 9.0 and 8.5 is vulnerable to blind server-side request forgery (SSRF) when handling SOAP requests. This allows an attacker to send crafted requests from the server to internal systems without direct visibility of the response.

Impact Analysis

An attacker could exploit this to interact with internal systems, potentially accessing sensitive data or initiating unauthorized actions. This could lead to data breaches, service disruption, or further network compromise depending on the server's configuration.

Compliance Impact

This vulnerability may violate compliance requirements such as GDPR (data protection) or HIPAA (health data security) by enabling unauthorized access to sensitive information. Organizations must address it to maintain regulatory compliance and avoid penalties.

Mitigation Strategies

Apply the latest IBM WebSphere Application Server patches or updates provided by IBM to address the blind server-side request forgery vulnerability in SOAP request processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15887. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart