WebSphere Application Server CVE-2026-9338

No special configuration is required based on the CVSS vector (AV:N/AC:L/PR:N/UI:N) - an unauthenticated attacker with network access to any HTTP or HTTPS listener on an affected WebSphere Application Server 8.5 or 9.0 instance can attempt exploitation. The primary limiting factor is network reachability: systems behind strict perimeter controls or accessible only to authenticated VPN users have substantially reduced exposure. Impact is bounded to availability degradation (A:L) rather than full service crash or data exposure, limiting the operational consequence even upon successful exploitation.

The CVSS 3.1 score of 5.3 (Medium) reflects a straightforward network-accessible, unauthenticated attack path (AV:N/AC:L/PR:N/UI:N) with only limited availability impact (A:L) and no confidentiality or integrity consequences (C:N/I:N). The A:L designation is significant: it suggests the server degrades but does not necessarily crash, which distinguishes this from a full denial-of-service. Neither CISA KEV listing nor a public proof-of-concept has been identified, and EPSS data was not provided - overall exploitation risk appears low at present. Even a mid-sized municipal IT team in gliwice running WAS in a public-facing capacity should treat this as a routine patch-cycle item rather than an emergency, since the zero-authentication barrier lowers the bar for opportunistic attempts while the limited impact constrains actual damage. The absence of EPSS and KEV data means exploitation probability cannot be independently quantified; risk is inferred primarily from the CVSS vector.

An unauthenticated remote attacker sends a sequence of specially crafted HTTP requests to a publicly reachable WebSphere Application Server 8.5 or 9.0 instance. The server fails to bound the resources consumed while processing these requests, causing thread pool or memory exhaustion that degrades responsiveness for legitimate users. No public exploit code has been identified, so successful exploitation likely requires knowledge of the specific malformed request structure triggering the resource leak.