What is the CVSS score of CVE-2026-9322?

CVE-2026-9322 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere Application Server are affected by CVE-2026-9322?

IBM WebSphere Application Server versions 8.5, 9.0, and WebSphere Liberty editions 17.0.0.3 through 26.0.0.7 are vulnerable to remote denial-of-service attacks that can disable application servers…. A patch is available.

How to fix or mitigate CVE-2026-9322?

Within 24 hours, identify and inventory all deployed IBM WebSphere Application Server instances (versions 8.5 and 9.0) and WebSphere Liberty servers (versions 17.0.0.3 through 26.0.0.7), prioritizing those with external or internet-facing HTTP listeners. Within 7 days, apply vendor-released patches from IBM for all affected versions to eliminate the vulnerability. Within 30 days, complete validation that all patches have been successfully deployed across your environment and that application functionality remains intact post-patch.

IBM WebSphere Application Server CVE-2026-9322

EUVD-2026-51230 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-30 ibm

GHSA-3h25-mhp4-65pq

IBM Denial Of Service Websphere Application Server Websphere Application Server Liberty

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Single crafted HTTP request over the network with no auth or interaction (AV:N/AC:L/PR:N/UI:N); pure availability impact with no confidentiality or integrity effect (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:20 vuln.today

CVE Published

Jul 30, 2026 - 16:13 cve.org

HIGH 7.5

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.

AnalysisAI

Denial of service in IBM WebSphere Application Server (9.0, 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers exhaust server resources by sending a single crafted HTTP request, forcing the application server to become unresponsive. The flaw (CWE-400, uncontrolled resource consumption) carries CVSS 7.5 with a full availability impact and requires no privileges or user interaction, making it trivially reachable on any exposed HTTP listener. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed WebSphere HTTP endpoint

Delivery

Send crafted HTTP request

Exploit

Trigger uncontrolled resource consumption

Execution

Exhaust threads/memory/connections

Impact

Server denial of service

Access

Identify exposed WebSphere HTTP endpoint

Delivery

Send crafted HTTP request

Exploit

Trigger uncontrolled resource consumption

Execution

Exhaust threads/memory/connections

Impact

Server denial of service

Vulnerability AssessmentAI

Exploitation	Exploitation requires only network reachability to a WebSphere Application Server 9.0/8.5 or Liberty 17.0.0.3-26.0.0.7 HTTP listener and the ability to send a single crafted HTTP request - no authentication, no user interaction, and no non-default configuration are indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes an easy, remote, unauthenticated, single-request attack with high availability impact but no confidentiality or integrity loss - a classic network DoS profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker locates an internet-facing WebSphere or Liberty HTTP endpoint and, without any credentials, sends one carefully crafted HTTP request that triggers uncontrolled resource consumption on the server. The server's threads, memory, or connection pool are exhausted, causing it to stop serving legitimate traffic; the request can be repeated to sustain the outage. …
Remediation	Patch available per vendor advisory - apply the fix referenced in IBM Security Bulletin https://www.ibm.com/support/pages/node/7278576; for traditional WebSphere 9.0 and 8.5 this means installing the interim fix (APAR/PH fix pack) IBM lists there, and for Liberty upgrading to the fixed 26.0.0.x runtime level identified in the bulletin (the exact fix pack version is not restated in the provided data, so confirm it against the advisory before scheduling). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and inventory all deployed IBM WebSphere Application Server instances (versions 8.5 and 9.0) and WebSphere Liberty servers (versions 17.0.0.3 through 26.0.0.7), prioritizing those with external or internet-facing HTTP listeners. …

Threat intelligence, references, and detailed analysis are available after sign-in.