Deserialization of Untrusted Data in IBM WebSphere Application Server - CVE-2026-9330

Vulnerability identifier: #VU133292

CSH Severity: Low

CVSS v4: 5.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H]

CVE-ID: CVE-2026-9330

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. A remote user can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

IBM WebSphere Application Server
Enterprise Application Runtimes
Tivoli Network Manager IP Edition
Cloud Pak for Applications
WebSphere Hybrid Edition
IBM Tivoli Netcool Configuration Manager
Tivoli Composite Application Manager for Application Diagnostics
Jazz for Service Management
Financial Transaction Manager for ACH Services and Check Services
IBM Tivoli System Automation Application Manager
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Tivoli Monitoring
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM Rational ClearQuest
IBM Business Automation Workflow

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 8.5.5.30, 9.0.5.29
IBM Tivoli Monitoring - update to 6.3.0.7 Service Pack 5

• https://www.ibm.com/support/pages/node/7274733

• Deserialization of untrusted data in IBM WebSphere Application Server
• Multiple vulnerabilities in IBM WebSphere Remote Server
• Multiple vulnerabilities in IBM Buinses Automation Workflow
• Multiple vulnerabilities in IBM Jazz for Service Management
• Multiple vulnerabilities in IBM Financial Transaction Manager for Check Services (Multiplatforms)
• Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
• Multiple vulnerabilities in IBM WebSphere Hybrid Edition
• Multiple vulnerabilities in IBM Enterprise Application Runtimes
• Multiple vulnerabilities in IBM Cloud Pak for Applications
• Multiple vulnerabilities in IBM Tivoli Composite Application Manager for Application Diagnostics
• Multiple vulnerabilities in IBM Guardium Key Lifecycle Manager (SKLM/GKLM)
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Multiple vulnerabilities in IBM Rational ClearQuest
• Multiple vulnerabilities in IBM Tivoli System Automation Application Manager