What is the CVSS score of CVE-2026-9006?

CVE-2026-9006 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of IBM WebSphere Application Server are affected by CVE-2026-9006?

IBM WebSphere Application Server versions 8.5 and 9.0 contain an unauthenticated server-side request forgery vulnerability allowing attackers to manipulate server requests and access internal systems…. A patch is available.

How to fix or mitigate CVE-2026-9006?

Within 24 hours: Identify all WebSphere 8.5/9.0 deployments with Ajax Proxy enabled; disable the proxy where operationally feasible. Within 7 days: Apply IBM vendor patches for WebSphere Application Server 8.5 and 9.0 across all production systems. Within 30 days: Execute vulnerability rescans to confirm patch application and validate that no unpatched instances remain.

IBM WebSphere Application Server CVE-2026-9006

EUVD-2026-38252 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-22 ibm

GHSA-57wv-8v6f-4353

IBM SSRF Information Disclosure Websphere Application Server

9.1

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.2 HIGH

Network-reachable proxy, no auth or UI needed; high confidentiality via SSRF reads, but integrity impact via forged requests is realistically low, not high.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 23, 2026 - 20:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 23, 2026 - 20:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 23, 2026 - 20:52 vuln.today

cvss_changed

Severity Changed

Jun 23, 2026 - 20:52 NVD

HIGH CRITICAL

CVSS changed

Jun 23, 2026 - 20:52 NVD

7.4 (HIGH) 9.1 (CRITICAL)

Analysis Generated

Jun 22, 2026 - 16:03 vuln.today

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

AnalysisAI

Server-side request forgery in IBM WebSphere Application Server 8.5 and 9.0 allows remote unauthenticated attackers to coerce the server into issuing arbitrary outbound requests when the Ajax Proxy is configured, enabling security bypass and information disclosure. IBM has released fixes and no public exploit is identified at time of analysis; EPSS is low (0.23%, 14th percentile) and SSVC marks exploitation as 'none' despite a CVSS of 9.1.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WebSphere host with Ajax Proxy

Delivery

Craft proxied request to internal target

Exploit

Submit to proxy servlet endpoint

Execution

WAS issues server-side request

Persist

Receive proxied response

Impact

Exfiltrate internal data or credentials

Access

Identify WebSphere host with Ajax Proxy

Delivery

Craft proxied request to internal target

Exploit

Submit to proxy servlet endpoint

Execution

WAS issues server-side request

Persist

Receive proxied response

Impact

Exfiltrate internal data or credentials

Vulnerability AssessmentAI

Exploitation	The Ajax Proxy component must be explicitly configured and reachable on the target WebSphere instance - it is not enabled by default, so exposure is limited to deployments that have provisioned a proxy servlet (typically via proxy-config.xml) for cross-domain XHR support. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals diverge sharply on this CVE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker on the network sends an HTTP request to the WebSphere Ajax Proxy endpoint with a target URL pointing at an internal-only service (e.g., http://localhost:9080/admin, an internal Redis instance, or a cloud metadata endpoint). WAS forwards the request server-side and returns the response, leaking internal data, session tokens, or cloud IAM credentials to the attacker. …
Remediation	Vendor-released patch: apply the Interim Fixes referenced in IBM advisory https://www.ibm.com/support/pages/node/7276600 - Interim Fix 017 for the 8.5 stream and Interim Fix 035 for the 9.0 stream - or upgrade to a Fix Pack that supersedes them. … Detailed patch versions, workarounds, and compensating controls in full report.