What is the CVSS score of CVE-2026-9071?

CVE-2026-9071 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere Application Server are affected by CVE-2026-9071?

IBM WebSphere Application Server (versions 8.5, 9.0) and WebSphere Liberty (17.0.0.3 through 26.0.0.6) contain a critical denial-of-service vulnerability allowing remote attackers to exhaust server…. A patch is available.

How to fix or mitigate CVE-2026-9071?

24 hours: Inventory all production and non-production instances of IBM WebSphere Application Server 8.5, 9.0 and WebSphere Liberty 17.0.0.3 through 26.0.0.6. 7 days: Apply vendor-released patch to all identified systems per IBM security advisory for CVE-2026-9071. 30 days: Verify patch deployment completion, validate system stability, and document remediation across all environments.

IBM WebSphere Application Server CVE-2026-9071

EUVD-2026-38253 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-22 ibm

GHSA-x466-m8cx-8p3m

IBM Denial Of Service Websphere Application Server Websphere Application Server Liberty

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity crafted request causes memory exhaustion - availability-only impact, no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 16:03 vuln.today

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

AnalysisAI

Denial of service in IBM WebSphere Application Server 8.5 and 9.0, plus WebSphere Liberty 17.0.0.3 through 26.0.0.6, allows remote unauthenticated attackers to exhaust server memory by sending a specially crafted request. The CVSS 7.5 score reflects high availability impact with no privileges or user interaction required, though no public exploit identified at time of analysis and no EPSS or KEV data is provided.

Technical ContextAI

WebSphere Application Server is IBM's flagship Java EE/Jakarta EE runtime, with the traditional profile (8.5, 9.0) running a full WAS kernel and the Liberty profile providing a lightweight, modular OSGi-based container widely used for microservices and cloud workloads. The flaw maps to CWE-400 (Uncontrolled Resource Consumption), meaning the request-handling path allocates memory in response to attacker-controlled input without enforcing adequate bounds, allowing memory pressure to build until garbage collection thrashes or the JVM exhausts heap. The affected CPEs cpe:2.3:a:ibm:websphere_application_server and cpe:2.3:a:ibm:websphere_application_server_-_liberty cover both the traditional and Liberty product lines across the version ranges noted.

RemediationAI

Patch available per vendor advisory - apply the interim fix or fix pack documented at https://www.ibm.com/support/pages/node/7276579 for the specific WAS 8.5, 9.0, or Liberty release in use. Where immediate patching is not possible, restrict network exposure of the application server by placing it behind a reverse proxy or WAF that can enforce request-size limits, rate limiting per source IP, and connection caps; tune JVM heap and request-thread limits to fail fast rather than degrade the whole node; and monitor for unusual memory-growth patterns. These compensating controls reduce blast radius but do not eliminate the underlying resource-consumption flaw and may reject legitimate large requests, so validate against application traffic profiles before deploying.