IBM WebSphere Application Server CVE-2026-9320

The target must be a reachable HTTP(S) endpoint served by IBM WebSphere Application Server 9.0 or 8.5 (traditional) or WebSphere Liberty 17.0.0.3-26.0.0.6, with the affected request-processing path exposed to the attacker; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated exploitation with no user interaction against default-reachable configurations. Exploitation is limited by network exposure (Liberty/WAS instances behind a WAF or reverse proxy that caps request size, rate, or concurrency may absorb the attack), by JVM heap and thread-pool sizing (large heaps merely raise the cost rather than prevent DoS), and by the version window - Liberty releases newer than 26.0.0.6 and any WAS traditional install already on 7.0.2 IF035 / 7.0.3 IF017 or later are not affected. Impact is availability-only (C:N/I:N/A:H), so no data exposure or code execution results.

Signals are mixed and lean toward moderate, not urgent, priority. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, A:H only) indicates trivial remote unauthenticated reachability with no confidentiality or integrity impact - a pure availability flaw. EPSS at 0.31% (23rd percentile) and CISA SSVC reporting Exploitation:none / Automatable:no / Technical Impact:partial all converge on low real-world exploitation likelihood. There is no KEV listing and no public POC identified at time of analysis. The realistic risk is that internet-exposed WAS/Liberty instances acting as front-end HTTP endpoints (especially without an upstream WAF or rate limiter) could be knocked offline by a low-volume crafted request, which matters most for high-availability workloads; the relatively narrow Liberty version window (17.0.0.3-26.0.0.6) and IBM's own reporting suggest a specific code path rather than a broad architectural issue.

An unauthenticated attacker on the network sends a specially-crafted HTTP request - or a small number of them - to an exposed WAS or Liberty endpoint. The vulnerable request handler allocates memory proportional to attacker-controlled input without bounds, growing the JVM heap until the server becomes unresponsive or the JVM terminates with OutOfMemoryError, taking the hosted applications offline. No public POC is identified at this time, so the attacker would need to derive the trigger from the IBM advisory or independent analysis.