IBM WebSphere Application Server CVE-2026-9336

Exploitation requires network reachability to the WebSphere administrative endpoint; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and CWE-306, no authentication or user interaction is needed, so any attacker able to reach that admin HTTP interface can trigger it. The primary limiting factor is network exposure of the administrative endpoint - deployments that restrict the admin console/SOAP/REST admin ports to management networks or behind firewalls substantially reduce exposure. Applies to WebSphere Application Server 9.0 and 8.5; impact is availability-only (filesystem-space exhaustion), which may require manual disk cleanup to fully recover.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity, unauthenticated availability-only impact, and the CWE-306 (Missing Authentication for a Critical Function) classification is internally consistent with PR:N - an administrative endpoint that should require authentication is reachable without it. The 7.5 score is driven entirely by A:H (filesystem-space exhaustion); there is no confidentiality or integrity impact, so this is a pure denial-of-service issue rather than a code-execution or data-breach flaw. Real-world urgency signals are modest: EPSS is 0.22% (13th percentile), there is no CISA KEV listing and no public exploit code identified, indicating no evidence of active or imminent widespread exploitation. This is best characterized as a genuine but lower-priority DoS: the unauthenticated remote reachability and the ubiquity of WebSphere in enterprise environments justify timely patching, but the availability-only impact and low EPSS argue against emergency escalation. No signals conflict - the network vector, unauthenticated access, and availability impact are mutually consistent; the main caveat is that 'exhaust filesystem space' implies a potentially persistent/hard-to-clear condition (disk full may require manual remediation) that raw CVSS A:H does not fully convey.

A remote attacker who can reach the WebSphere administrative HTTP endpoint sends repeated specially-crafted HTTP requests that cause the server to write or retain data until the underlying filesystem fills up, halting logging, deployments, or the server itself. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N). No public exploit code has been identified at time of analysis.