What is the CVSS score of CVE-2026-9330?

CVE-2026-9330 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM WebSphere Application Server are affected by CVE-2026-9330?

IBM WebSphere Application Server versions 9.0 and 8.5 contain a vulnerability in SAML authentication that allows authenticated users to execute code with elevated privileges and move laterally…. A patch is available.

How to fix or mitigate CVE-2026-9330?

Within 24 hours: Inventory all WebSphere 9.0 and 8.5 instances and assess their network exposure. Within 7 days: Apply IBM patch via support advisory node/7274733 to all affected systems, prioritizing production environments. Within 30 days: Verify patch deployment completeness, review authentication logs for exploitation attempts, and validate application functionality post-patch.

IBM WebSphere Application Server CVE-2026-9330

EUVD-2026-33740 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-01 ibm

GHSA-xrfh-q76x-p6f2

IBM RCE Deserialization Websphere Application Server

8.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 19:20 vuln.today

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.

AnalysisAI

Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows authenticated attackers to abuse unsafe Java deserialization in the SAML Web Single Sign-On component to run arbitrary code via a crafted HTTP request combined with a gadget chain. The flaw carries a CVSS 8.5 with scope change, and while no public exploit has been identified at time of analysis, deserialization gadget chains for WebSphere are historically well-researched. IBM has released a patch via support advisory node/7274733.

Technical ContextAI

WebSphere Application Server is IBM's flagship Java EE/Jakarta EE runtime used to host enterprise web applications, frequently fronted by SAML-based identity federation. The vulnerable code path lives in the SAML Web SSO component, which deserializes user-supplied data without adequate validation - a CWE-502 (Deserialization of Untrusted Data) condition. In Java stacks, this class of bug is typically exploited by submitting a serialized object graph that, on readObject(), traverses a 'gadget chain' (often from libraries on the classpath such as commons-collections, ROME, or WebSphere's own internal classes) to reach a Runtime.exec or equivalent sink. Per the CPE (cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*), all sub-versions of the 9.0 and 8.5 branches are potentially in scope until the IBM-provided interim fix is applied.

RemediationAI

Apply the patch referenced in IBM's support bulletin at https://www.ibm.com/support/pages/node/7274733, installing the IBM-supplied interim fix or Fix Pack for the 9.0 and 8.5 branches as appropriate to your deployed baseline (Vendor-released patch: see IBM advisory for branch-specific iFix levels). If immediate patching is not feasible, compensating controls include disabling the SAML Web Single Sign-On TAI/feature in WebSphere security configuration if SAML federation is unused (side effect: any SAML-authenticated applications will break and must fall back to LDAP/Kerberos), restricting network access to the SAML ACS endpoint at the load balancer or WAF so that only trusted IdP egress IPs can POST to it (side effect: federated logins from off-network users will fail), and enabling WebSphere's serialization filter (com.ibm.websphere.serialfilter / JEP 290-style filtering) to deny-list known gadget classes such as commons-collections InvokerTransformer and ROME's ToStringBean (side effect: legitimate apps relying on those classes via RMI/JMS may break and require allow-list tuning).