What is the CVSS score of EUVD-2026-33737?

EUVD-2026-33737 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM WebSphere Application Server are affected by EUVD-2026-33737?

IBM WebSphere Application Server versions 9.0 and 8.5 contain a critical remote code execution vulnerability in JAX-WS endpoints that allows unauthenticated attackers to execute arbitrary code…. A patch is available.

How to fix or mitigate EUVD-2026-33737?

Within 24 hours: Conduct inventory of all WebSphere 9.0 and 8.5 deployments; restrict network access to JAX-WS/SOAP endpoints to internal networks only. Within 7 days: Apply IBM security patch for CVE-2026-9319 to all affected WebSphere instances. Within 30 days: Complete patch validation across all environments and verify JAX-WS functionality post-remediation.

IBM WebSphere Application Server EUVD-2026-33737

| CVE-2026-9319 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-01 ibm

GHSA-rqhj-2grh-m6c2

IBM RCE Deserialization Websphere Application Server

9.0

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 19:20 vuln.today

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.

AnalysisAI

Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 arises from unsafe deserialization of untrusted data processed by JAX-WS endpoints that use WS-Security. Unauthenticated remote attackers who can reach a SOAP/JAX-WS endpoint may craft malicious serialized payloads to execute arbitrary code in the WebSphere server context. No public exploit identified at time of analysis, but the high CVSS (9.0) and scope-changed impact mean any exposed JAX-WS service is a meaningful target.

Technical ContextAI

WebSphere Application Server (WAS) is IBM's flagship Java EE/Jakarta EE runtime hosting enterprise applications, including SOAP web services implemented via JAX-WS (Java API for XML Web Services). WS-Security is the OASIS standard that signs, encrypts, and adds security tokens to SOAP messages, and its processing pipeline often involves parsing complex XML and Java-typed payloads. The root cause is CWE-502 (Deserialization of Untrusted Data): WAS deserializes Java objects embedded in or referenced by WS-Security-protected SOAP messages without sufficient type filtering, allowing attacker-controlled gadget chains on the WAS classpath to execute during readObject/readResolve. CPE coverage (cpe:2.3:a:ibm:websphere_application_server:*) indicates the JAX-WS/WS-Security stack shipped with WAS is the vulnerable component rather than a deployed customer application.

RemediationAI

Patch available per vendor advisory: apply the interim fix or fix pack referenced in IBM Security Bulletin https://www.ibm.com/support/pages/node/7274738 for both the 9.0 and 8.5 release streams (consult that bulletin for the exact iFix/PTF identifier matching your installed fix-pack level, as IBM did not publish a single canonical version string in the input data). Where immediate patching is not possible, compensating controls include disabling or undeploying JAX-WS web services that are not business-critical (this will break any SOAP clients depending on them), restricting network reachability of the SOAP endpoints to trusted internal networks via firewall or reverse-proxy ACLs (reduces blast radius but does not protect against authenticated insiders), and turning off WS-Security on endpoints where it is not required (this removes the vulnerable code path but degrades message-level security guarantees and may violate compliance policies). Enabling WAS's serialization filter (com.ibm.websphere.serialization.filter.allowList / denyList) to restrict permitted classes is an additional hardening step that reduces gadget-chain exposure without removing functionality.