EUVD-2026-50031
GHSA-3943-mgp9-h6fv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization yields RCE with full confidentiality, integrity, and availability impact, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.
AnalysisAI
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network attacker to run arbitrary code by sending crafted serialized data that the server deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 rating with a network attack vector and no authentication or user interaction required, though SSVC records exploitation as none observed and no public exploit was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to a WebSphere Application Server traditional 8.5 or 9.0 endpoint that accepts and deserializes untrusted Java objects (such as the IIOP/ORB, RMI, or management/messaging channels). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here partly conflict and warrant nuance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reachability to a WebSphere traditional listener crafts a malicious serialized Java object embedding a gadget chain and delivers it to a deserialization endpoint (for example over IIOP/RMI). When the server invokes readObject on the untrusted stream, the gadget chain executes attacker-supplied commands with the privileges of the WebSphere process. … |
| Remediation | Apply the vendor fix per IBM's advisory at https://www.ibm.com/support/pages/node/7281641, which provides the interim fix or fix pack addressing the deserialization flaw for WebSphere Application Server traditional 8.5 and 9.0; a patch is available from the vendor, though an exact fix-pack version was not provided in the input data and should be taken directly from IBM's advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an urgent inventory of all WebSphere Application Server 8.5 and 9.0 instances and immediately disable internet-facing access or restrict network connections to trusted sources only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Websphere Application Server
View allIBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Co
Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown i
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unau
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Libe
HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 thr
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Serv
Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today