EUVD-2026-100493
GHSA-5q74-39hp-qp43
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed messaging service endpoint
-
DeliveryCraft malicious serialized object
-
ExploitSubmit payload to deserialization path
-
ExecutionExhaust resources or crash engine
-
ImpactDenial of service to messaging clients
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the WebSphere/Liberty messaging service (the SIB/JMS messaging engine) that performs the insecure deserialization; the vulnerable code path is only exercised where that messaging component is enabled and accepting input. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed once the endpoint is reachable, and attack complexity is low (AC:L). The primary limiting factor is deployment exposure: environments that do not enable the messaging service, or that restrict it to trusted internal networks via firewalling/segmentation, materially reduce real-world reachability. Impact is confined to availability - no data disclosure or integrity compromise (C:N/I:N). |
| Impact | This is a genuine but bounded-impact issue. The IBM-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent and describes a remotely reachable, low-complexity flaw requiring no authentication or user interaction, but with impact limited strictly to availability (C:N/I:N) - fitting the CWE-502 insecure-deserialization-driven denial of service in the messaging service. No EPSS score, no CISA KEV listing, and no public exploit were provided in the intelligence set, so there is no evidence of active or probable near-term exploitation: no public exploit identified at time of analysis. The signals do not conflict so much as they are sparse - a high-CVSS availability bug in widely deployed middleware, but currently lacking any exploitation-probability or in-the-wild corroboration. Treat this as a patch-in-normal-cycle priority for externally reachable WebSphere/Liberty messaging endpoints rather than an emergency, and re-evaluate if EPSS data or a POC emerges. Note one caveat: PR:N assumes the messaging service accepts untrusted input without authentication, which depends on how the messaging engine is exposed; verify against your deployment and IBM advisory. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network reach to the WebSphere messaging service (e.g., the SIB/JMS messaging engine) sends a crafted serialized object that the service deserializes insecurely, consuming resources or crashing the processing path and denying service to legitimate clients. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or race conditions are required once the endpoint is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Denial of service in IBM WebSphere Application Server 8.5 and 9.0, and in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10, allows remote unauthenticated attackers to disrupt availability by sending crafted serialized data to the product's messaging service. The root cause is insecure deserialization (CWE-502) in the messaging component, rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so impact is confined to availability - confidentiality and integrity are not affected. Per the assessed vector, no credentials or user interaction are required once the messaging endpoint is reachable, but the vulnerable code path is only exercised where the messaging engine (SIB/JMS) is enabled and accepting input; environments that disable it or restrict it to trusted networks are materially less exposed. There is no public exploit identified at time of analysis, and this CVE is not listed as confirmed actively exploited (CISA KEV).
RemediationAI
No vendor-released patch version was identified in the available intelligence at time of analysis, so the first step is to consult the IBM advisory at https://www.ibm.com/support/pages/node/7292221 for the applicable interim fix or fix-pack level for WebSphere Application Server 8.5, 9.0, and the Liberty 17.0.0.3-26.0.0.10 stream, and apply it once published; Liberty users should also verify their current runtime level against IBM's recommended fix level since that product line is delivered continuously. Until a fix is applied, the most effective compensating control is to reduce reachability of the vulnerable messaging service: disable the SIB/JMS messaging engine where it is not operationally required (acceptable when no messaging-dependent applications exist, but it will break any JMS-based integrations), or, where messaging must remain available, firewall and network-segment the messaging ports and endpoints so that only trusted internal producers can reach them - this preserves functionality but requires maintaining accurate allow-lists. Deploying a filtering reverse proxy or Java deserialization allow-list agent in front of the messaging listener adds a second layer, though it can introduce latency and requires tuning to avoid blocking legitimate serialized payloads, and monitoring for repeated malformed-message errors against the messaging engine provides useful early warning. Because impact is availability-only, an effective interim posture can also include rate limiting and health-check-driven automatic restarts of the affected server to limit outage duration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an insecure deserialization issue (CWE-502) in the messaging service of IBM WebSphere Application Server and WebSphere Application Server - Liberty. In Java application servers, the messaging engine (the Service Integration Bus / JMS layer in traditional WebSphere, and the equivalent messaging runtime in Liberty) accepts serialized message payloads and reconstitutes them into objects on the server side. When such data is accepted from an untrusted source and deserialized without adequate type filtering or allow-listing, an attacker can supply a crafted serialized stream that consumes excessive resources or triggers an unhandled state in the deserialization path, resulting in denial of service rather than code execution or data exposure - consistent with the assessed vector's C:N/I:N/A:H profile. The affected technology stack spans the WebSphere Application Server 8.5 and 9.0 releases and the Liberty continuously-delivered stream from 17.0.0.3 through 26.0.0.10; no CPE strings were supplied with the source data, so exact platform/edition bindings should be confirmed against the IBM advisory. Note that deserialization flaws in Java servers can sometimes be escalated beyond DoS, but in this case the authoritative assessment confirms availability-only impact, and that scope should not be overstated.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote network-facing messaging service with no auth or interaction gives AV:N/AC:L/PR:N/UI:N; deserialization DoS yields A:H only, with C:N/I:N and unchanged scope.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
Executive ViewAI
IBM WebSphere Application Server 8.5 and 9.0, and WebSphere Liberty versions 17.0.0.3 through 26.0.0.10, are affected by a high-severity denial-of-service vulnerability in the messaging service that could disrupt business-critical applications relying on these platforms. Unauthenticated remote attackers could exploit this flaw to cause availability outages, though no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Leadership should prioritize mitigation because many enterprises depend on WebSphere for transaction processing and customer-facing services, and a successful attack could halt operations.
No vendor-released patch identified at time of analysis. Interim mitigations: Disable the messaging engine (SIB/JMS) if not required. If required, restrict network access to the messaging service to trusted internal networks only via firewall rules and network segmentation. Deploy WAF rules to inspect and block malicious serialized payloads. Monitor logs for unusual serialized data or service disruptions. Engage IBM support for any available workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB