PT-2026-45545 · Ibm · Ibm Websphere Application Server

CVE-2026-9330 · Published 2026-06-01 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5

Description Improper validation of user-supplied data occurs during deserialization within the SAML Web Single Sign-On component. This flaw allows remote code execution via a crafted HTTP request when combined with a suitable gadget chain, which is a sequence of existing code fragments used to execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-9330

Affected Products

Ibm Websphere Application Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-9330 · Security Note
• https://twitter.com/CCBalert/status/2061805487553740918 · Twitter Post
• https://ibm.com/support/pages/node/7274733 · Patch, Vendor Advisory
• https://twitter.com/knaepp/status/2061487998709981512 · Twitter Post