CVE Intelligence
Analysis AI-assisted

CVE-2026-9319: IBM WebSphere Application Server remote code execution via untrusted deserialization in JAX-WS

IBM WebSphere Application Server 9.0 and 8.5 is described as vulnerable to potential remote code execution through deserialization of untrusted data in JAX-WS endpoints that use WS-Security. The CNA rates the issue critical, and the record classifies it as CWE-502. No confirmed exploitation appears in the sources consulted, and the record lists no fixed versions, so the IBM advisory should be checked.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

IBM WebSphere Application Server 9.0 and 8.5 is described as vulnerable to potential remote code execution caused by deserialization of untrusted data through JAX-WS endpoints that use WS-Security. The weakness is classified as CWE-502 (Deserialization of Untrusted Data).

Impact

  • The CNA rates the base score at 9 (critical), with high confidentiality, integrity and availability impact and a scope change.
  • The description states the potential outcome is remote code execution.
  • Actual impact depends on whether the vulnerable endpoints are reachable and configured as described.

Affected products and versions

  • IBM WebSphere Application Server, per the record: from 8.5.0.0 before 8.5.5.30, and from 9.0.0.0 before 9.0.5.29.
  • The record also lists an entry written as "≥ 9.0 and ≤ 1.1.9.12" and a bare "version 8.5". The first entry is internally inconsistent and should be verified against the vendor advisory.

Exploitation status

  • The CISA KEV catalog does not list this CVE.
  • The SSVC fields in the record show exploitation as none and automatable as no.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the IBM support advisory and apply the vendor-provided fix for your release line. The record does not list fixed versions.
  • Confirm the installed level against the ranges above before and after remediation.
  • If patching is delayed, restrict network access to JAX-WS endpoints that use WS-Security to trusted sources, and review whether those endpoints are needed.

Detection guidance

  • Maintain an inventory of WebSphere instances, their fix levels and whether JAX-WS with WS-Security is enabled.
  • Monitor application server logs for unexpected requests to JAX-WS endpoints and for unusual process or outbound network activity from server processes.

Limitations of the available information

  • The record contains no fixed-version list, and one affected-version entry is malformed.
  • The EPSS record shows a probability of 0.00621 and a percentile of 0.4914, with a date later than the publication date, so it should be interpreted with care.
  • The IBM advisory was not reviewed in this analysis, so vulnerable code paths, configuration prerequisites and fix details are unknown.

Frequently asked questions

Is CVE-2026-9319 known to be actively exploited?

The CISA KEV catalog does not list it, and the SSVC fields show exploitation as none. No confirmed exploitation appears in the sources consulted.

Which WebSphere versions are affected?

The record lists ranges from 8.5.0.0 before 8.5.5.30 and from 9.0.0.0 before 9.0.5.29. One entry is malformed, so check the IBM advisory before relying on it.

What should administrators do first?

Identify WebSphere instances using JAX-WS with WS-Security, apply the vendor fix from the IBM advisory, and restrict access to these endpoints while patching is pending.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.