EUVD-2026-50447
GHSA-545h-jr28-6wfq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, unauthenticated, low-complexity when SIP feature is enabled, so AV:N/AC:L/PR:N; SSRF strongly enables confidentiality (C:H) but integrity/availability impact is secondary and less certain (I:L/A:L).
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.
AnalysisAI
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.8) lets remote unauthenticated attackers coerce the server into issuing arbitrary requests when the SIP container feature (sipServlet-1.1) is enabled. The flaw carries a CVSS 9.8 rating with total technical impact, and IBM has released a fix (advisory node/7281721); no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.33%.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The decisive prerequisite, taken directly from the description, is that the SIP container feature (sipServlet-1.1) must be enabled on the target WebSphere instance - SSRF is only reachable through the SIP servlet code path, and this feature is not part of a default WebSphere/Liberty configuration, which is the primary factor limiting real-world exposure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and warrant careful prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach a WebSphere server running the SIP container sends a crafted SIP servlet request whose embedded target causes the container to open a connection to an internal address the attacker chooses (e.g., a cloud metadata endpoint or an internal admin service). Because no authentication is required and complexity is low, the request is processed and the server relays it, letting the attacker probe or interact with internal systems otherwise unreachable. … |
| Remediation | Apply the IBM-provided fix documented in the vendor advisory at https://www.ibm.com/support/pages/node/7281721 (Patch available per vendor advisory); consult that page for the exact interim fix / fix pack level for your specific traditional 9.0, 8.5, or Liberty release, as an exact fix version is not enumerated in the available data - do not apply an unverified version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IBM WebSphere Application Server deployments in your environment and determine which have the SIP servlet feature (sipServlet-1.1) enabled-these systems are at immediate risk and should be prioritized for remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Websphere Application Server
View allIBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Co
Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown i
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unau
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Libe
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network at
HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 thr
Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today