What is the CVSS score of CVE-2026-9336?

CVE-2026-9336 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-9336?

Yes, a patch is available for CVE-2026-9336. Update the affected software to the latest version immediately.

WebSphere Application Server CVE-2026-9336

EUVD-2026-75677 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-09-10 ibm

GHSA-fw6w-g4f4-936x

Denial Of Service IBM Websphere Application Server

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

AV:A reflects admin interface on management-segment; PR:N confirmed by CWE-306 (missing auth); A:H from full filesystem exhaustion; no confidentiality or integrity impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 10, 2026 - 19:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 10, 2026 - 19:19 vuln.today

CVE Published

Sep 10, 2026 - 18:45 cve.org

MEDIUM 6.5

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space.

AnalysisAI

Filesystem exhaustion denial of service in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated adjacent-network attacker to crash the server by sending specially crafted HTTP requests to an administrative endpoint that lacks authentication (CWE-306). Repeated triggering fills the host filesystem, disrupting all applications deployed on the instance and preventing logging or recovery operations. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires adjacent network access (CVSS AV:A) - the attacker must be on the same network segment or broadcast domain as the target WebSphere administrative interface, such as a shared management VLAN or internal corporate network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 6.5 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the primary risk modifier: the adjacent-network attack vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	IBM has released a patch for this vulnerability; administrators should consult the IBM support advisory at https://www.ibm.com/support/pages/node/7286610 for the exact fix version and installation instructions. … Detailed patch versions, workarounds, and compensating controls in full report.