EUVD-2025-19137CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.
AnalysisAI
IBM WebSphere Application Server (WAS) versions 8.5 and 9.0 are vulnerable to remote code execution through deserialization of untrusted serialized objects, allowing unauthenticated network attackers to execute arbitrary code with high confidence despite moderate attack complexity. This is a critical Java deserialization vulnerability (CWE-502) affecting enterprise application servers in widespread use; exploitation status and EPSS probability are not yet public but the CVSS 9.0 score and network-accessible attack vector indicate this is a priority concern for organizations running affected WAS versions.
Technical ContextAI
The vulnerability exploits unsafe Java object deserialization (CWE-502: Deserialization of Untrusted Data) in IBM WebSphere Application Server. Java deserialization attacks leverage gadget chains in available libraries to achieve remote code execution when an attacker can control the serialized object stream sent to the application. WAS versions 8.5 and 9.0 contain logic that deserializes objects from network input without proper validation, allowing an attacker to craft a malicious serialized payload that triggers arbitrary code execution during object reconstruction. The attack requires network access (AV:N) but has higher than trivial complexity (AC:H), likely due to the need to craft a specific gadget chain or exploit timing. This affects the core WAS runtime and potentially impacts both standalone and distributed deployments (clustered environments noted in CVSS:S:C scope change).
RemediationAI
Immediate actions: (1) Apply IBM security patch when released (monitor IBM Security Bulletin and WAS security advisories at ibm.com/support); (2) For WAS 8.5: upgrade to latest fix pack or migrate to supported WAS 9.0.5.x or newer if available after patches are released; (3) For WAS 9.0: apply interim fix or upgrade to 9.0.5.x+ (patch version TBD pending vendor release). Interim mitigations pending patch availability: (a) Network segmentation—restrict network access to WAS administrative ports and cluster communication ports to trusted networks only; (b) Disable unnecessary RMI/JMX interfaces if not required; (c) Implement Web Application Firewall (WAF) rules to block serialized object signatures in HTTP payloads (proactive, not guaranteed); (d) Monitor for unusual deserialization errors in logs. Workaround: none definitive; patch is mandatory. Vendor advisory: await IBM WebSphere Application Server security bulletin (typically at ibm.com/support/pages/security-bulletins).
More from same product – last 7 days
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.1 lets unauthenticated network attackers run arbitr
Remote code execution and authentication bypass are possible in IBM Aspera High-Speed Transfer Server and High-Speed Tra
Authentication bypass in IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) versions 1.5.1 throu
Hard-coded credentials in IBM Controller (versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2) give attackers a static, embedded
Arbitrary code execution in IBM Aspera High-Speed Transfer Server and Endpoint (versions 3.7.4 through 4.4.7 Fix Pack 1)
Share
External POC / Exploit Code
Leaving vuln.today