CVE-2026-9319

CriticalCVSS 9.0

Published: 01/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

37th percentile - higher than 37% of all known CVEs

Summary

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.

Risk Assessment

Attackers can remotely execute arbitrary code on the server, leading to full application and data compromise.

Recommendation

Apply the security patch from IBM and consider disabling unnecessary JAX-WS endpoints with WS-Security.

Original NVD description (English source)

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.