IBM WebSphere Application Server CVE-2026-9071

No special conditions - remote unauthenticated exploitation against default configurations of IBM WebSphere Application Server traditional 8.5/9.0 and Liberty 17.0.0.3 through 26.0.0.6, requiring only network reachability to a listening WAS HTTP or service endpoint. Limiting factors: the target endpoint must be reachable from the attacker (instances behind WAFs, internal-only deployments, or mTLS-fronted listeners are harder to reach), and the precise request shape that triggers excessive allocation is not disclosed by IBM, so weaponization requires either fuzzing or details from IBM's private advisory.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a network-reachable, low-complexity, unauthenticated attack producing high availability impact with no confidentiality or integrity consequences - a classic remote DoS profile. EPSS, KEV status, and SSVC decision data are not provided in the input, so exploitation probability cannot be quantified, and no public exploit identified at time of analysis. Real-world risk is meaningful for any internet-exposed WebSphere instance because the trigger is a single crafted request requiring no credentials, but absence of code execution or data exposure means this is typically a Priority 2 rather than emergency-patch issue - unless the WAS instance fronts a business-critical workload where outage cost is high.

An attacker on the network sends one or more specially crafted requests to an exposed WebSphere or Liberty HTTP/SOAP endpoint; the server allocates excessive memory while parsing or processing the request, and repeated requests drive the JVM into garbage-collection thrashing or OutOfMemoryError, taking the application offline. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the attack can be automated from any internet host without credentials or social engineering.