IBM WebSphere Application Server CVE-2026-9006

The Ajax Proxy component must be explicitly configured and reachable on the target WebSphere instance - it is not enabled by default, so exposure is limited to deployments that have provisioned a proxy servlet (typically via proxy-config.xml) for cross-domain XHR support. No authentication or user interaction is required (PR:N/UI:N) and the attack works over the network against WebSphere 8.5 or 9.0 versions prior to the listed Interim Fixes. Real-world impact further depends on what internal endpoints are reachable from the WAS host's network position; segmentation that blocks outbound traffic to sensitive services degrades the achievable impact even if the SSRF itself succeeds.

Signals diverge sharply on this CVE. CVSS 3.1 rates it 9.1 Critical (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N), reflecting that an unauthenticated remote attacker can reach the proxy over the network with low complexity and obtain high confidentiality and integrity impact via the forged requests. However, EPSS is only 0.23% (14th percentile), CISA SSVC records Exploitation=none and Automatable=no, and the vulnerability is not in CISA KEV - indicating no observed exploitation activity despite the high theoretical severity. The Technical Impact=total rating in SSVC reinforces that successful exploitation is damaging, but the realistic prerequisite is that the Ajax Proxy be configured (not the default) and reachable, which materially limits the exposed population. Net priority: high for shops that actually deploy the Ajax Proxy or front internal services with WAS; moderate for typical installations.

An unauthenticated attacker on the network sends an HTTP request to the WebSphere Ajax Proxy endpoint with a target URL pointing at an internal-only service (e.g., http://localhost:9080/admin, an internal Redis instance, or a cloud metadata endpoint). WAS forwards the request server-side and returns the response, leaking internal data, session tokens, or cloud IAM credentials to the attacker. No public exploit is identified at time of analysis, but the proxy semantics make weaponization straightforward once an endpoint is located.