Server-side Request Forgery Vulnerability in IBM WebSphere Application Server
CVE-2026-9006

7.4HIGH

Key Information:

Vendor

IBM
Status
Websphere Application Server
Vendor
CVE Published:
22 June 2026

What is CVE-2026-9006?

IBM WebSphere Application Server versions 9.0 and 8.5 are susceptible to a server-side request forgery (SSRF) vulnerability when the Ajax Proxy is configured. This flaw could enable attackers to exploit the system by sending unauthorized requests, which may lead to a bypass of security measures or potentially expose sensitive information. It is crucial for organizations using these affected versions to apply available security patches to mitigate the risks associated with this vulnerability.

Affected Version(s)

WebSphere Application Server 9.0 <= 7.0.2 Interim Fix 035

WebSphere Application Server 8.5.0 <= 7.0.3 Interim Fix 017

References

https://www.ibm.com/support/pages/node/7276600
vendor-advisorypatch

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.