What is the CVSS score of CVE-2026-9320?

CVE-2026-9320 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere Application Server are affected by CVE-2026-9320?

IBM WebSphere Application Server versions 9.0, 8.5, and Liberty 17.0.0.3-26.0.0.6 contain a vulnerability allowing remote attackers to trigger denial-of-service conditions that exhaust server memory…. A patch is available.

How to fix or mitigate CVE-2026-9320?

Within 24 hours: Inventory all IBM WebSphere Application Server instances (versions 9.0, 8.5, and Liberty 17.0.0.3-26.0.0.6) across the organization to determine exposure scope. Within 7 days: Apply IBM support advisory 7276579 patch to all affected systems via change management process during maintenance windows. Within 30 days: Confirm patching completion across all systems and establish ongoing monitoring to detect DoS attack patterns or memory exhaustion.

IBM WebSphere Application Server CVE-2026-9320

EUVD-2026-38254 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-22 ibm

GHSA-j7mw-rcxc-j56c

Denial Of Service IBM Websphere Application Server Websphere Application Server Liberty

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP request with no user interaction triggers memory exhaustion; availability-only impact, no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 23, 2026 - 21:02 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 23, 2026 - 21:01 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 23, 2026 - 20:52 vuln.today

cvss_changed

Severity Changed

Jun 23, 2026 - 20:52 NVD

MEDIUM HIGH

CVSS changed

Jun 23, 2026 - 20:52 NVD

5.9 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Jun 22, 2026 - 16:07 vuln.today

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

AnalysisAI

Denial of service in IBM WebSphere Application Server 9.0 and 8.5, and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6, allows remote unauthenticated attackers to exhaust server memory by sending specially-crafted requests. CVSS 7.5 (availability-only impact) with no public exploit identified at time of analysis and a low EPSS score of 0.31% (23rd percentile). IBM has released a patch via support advisory 7276579; CISA SSVC currently rates exploitation status as 'none'.

Technical ContextAI

WebSphere Application Server (WAS) is IBM's enterprise Java EE/Jakarta EE application server, deployed in two main lineages: the traditional full-profile WAS (versions 8.5, 9.0) and the lightweight, modular WebSphere Liberty runtime (17.0.0.3 through 26.0.0.6). The CPE strings cpe:2.3:a:ibm:websphere_application_server and cpe:2.3:a:ibm:websphere_application_server_-_liberty confirm both product families are affected. The flaw is classified as CWE-400 (Uncontrolled Resource Consumption), meaning a request-handling code path allocates memory without bounding it against attacker-controlled input - repeated or crafted requests force the JVM heap to grow until the server stalls, throws OutOfMemoryError, or is killed by the OS.

RemediationAI

Vendor-released patch is available per the IBM advisory at https://www.ibm.com/support/pages/node/7276579 - apply the corresponding interim fix for your branch (post-7.0.2 IF035 for WAS 9.0, post-7.0.3 IF017 for WAS 8.5) and upgrade Liberty to a release beyond 26.0.0.6. Until patching completes, place WAS/Liberty endpoints behind a reverse proxy or WAF that enforces request size, rate, and concurrency limits on the specific HTTP paths exposed by the application, and tune JVM heap and request thread pool limits so a single client cannot exhaust the runtime (trade-off: legitimate large requests may be throttled). Restrict network exposure of management and unused HTTP listeners to trusted segments, and monitor JVM heap usage and OutOfMemoryError events to detect attempted exploitation.