CVE Intelligence
Analysis AI-assisted

CVE-2026-9006: IBM WebSphere Application Server SSRF in Ajax Proxy

CVE-2026-9006 is a server-side request forgery (CWE-918) in IBM WebSphere Application Server 9.0 and 8.5 when the Ajax Proxy is configured. NVD scores it 9.1 (CVSS 3.1, Critical), while IBM's PSIRT scores it 7.4. No confirmed exploitation appears in the sources consulted, and the record lists no fixed versions, so administrators should check IBM's advisory directly.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

IBM WebSphere Application Server 9.0 and 8.5 are affected by a server-side request forgery weakness (CWE-918) when the Ajax Proxy is configured. The description and CWE mapping come from the NVD entry, and IBM's vendor advisory is linked from the IBM support page.

Impact

The record states that an attacker may be able to send unauthorized requests from the affected system. The stated consequences are a security bypass or information disclosure.

  • NVD scores the issue 9.1 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
  • The IBM PSIRT entry in the record scores it 7.4 under CVSS 3.1.
  • The weakness is mapped to CWE-918.

Affected products and versions

The record lists IBM WebSphere Application Server in two ranges: from 8.5.0.0 up to but not including 8.5.5.30, and from 9.0.0.0 up to but not including 9.0.5.29. The Ajax Proxy must be configured for the issue to apply, as described in the source text.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed by that source. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review IBM's advisory linked above for the authoritative fixed levels and interim guidance.
  • The affected ranges end at 8.5.5.30 and 9.0.5.29, which suggests those levels contain the fix, but the record does not state this explicitly.
  • If the Ajax Proxy is not needed, disabling it reduces exposure. Confirm the effect on your environment before changing production settings.

Detection guidance

  • Review whether the Ajax Proxy is enabled in server configurations.
  • Monitor outbound requests from application servers to internal networks, metadata endpoints or unexpected hosts.
  • Correlate unusual proxied requests in web and application logs with the affected components.

Limitations of the available information

The record has no title, no fixed versions in the fixes field, no EPSS score and no SSVC data. The IBM PSIRT and NVD scores differ, and the exact exploit preconditions beyond the Ajax Proxy configuration are not described in the record.

Frequently asked questions

What is CVE-2026-9006?

It is a server-side request forgery weakness (CWE-918) in IBM WebSphere Application Server 9.0 and 8.5 when the Ajax Proxy is configured, according to the NVD record.

Is this vulnerability being actively exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record lists 8.5.0.0 up to but not including 8.5.5.30, and 9.0.0.0 up to but not including 9.0.5.29. Check IBM's advisory for the official fixed levels.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.