Deserialization of Untrusted Data in IBM WebSphere Application Server - CVE-2026-9319

Vulnerability identifier: #VU133289

CSH Severity: High

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H]

CVE-ID: CVE-2026-9319

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to deserialization of untrusted data via JAX-WS endpoints with WS-Security. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

IBM WebSphere Application Server
Enterprise Application Runtimes
WebSphere Hybrid Edition
Cloud Pak for Applications
IBM Tivoli Netcool Configuration Manager
Tivoli Composite Application Manager for Application Diagnostics
Jazz for Service Management
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Tivoli System Automation Application Manager
IBM Tivoli Monitoring
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM Rational ClearQuest
IBM Business Automation Workflow
IBM Tivoli Network Manager (ITNM)

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 8.5.5.30, 9.0.5.29
IBM Tivoli Monitoring - update to 6.3.0.7 Service Pack 5

• https://www.ibm.com/support/pages/node/7274738

• Deserialization of untrusted data in IBM WebSphere Application Server
• Deserialization of untrusted data in IBM WebSphere Remote Server
• Multiple vulnerabilities in IBM Buinses Automation Workflow
• Deserialization of untrusted data in IBM Jazz for Service Management
• Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
• Deserialization of untrusted data in IBM WebSphere Hybrid Edition
• Deserialization of untrusted data in IBM Enterprise Application Runtimes
• Deserialization of untrusted data in IBM Tivoli Composite Application Manager for Application Diagnostics
• Deserialization of untrusted data in IBM Cloud Pak for Applications
• Deserialization of untrusted data in IBM Guardium Key Lifecycle Manager (SKLM/GKLM)
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM Tivoli Network Manager (ITNM)
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Deserialization of untrusted data in IBM Tivoli System Automation Application Manager
• Deserialization of untrusted data in IBM Rational ClearQuest