CVE-2026-11711 Overview
CVE-2026-11711 is a deserialization vulnerability affecting the Name Service component of IBM WebSphere Application Server versions 9.0 and 8.5. An adjacent-network attacker can send a crafted serialized object to the Name Service and trigger unsafe deserialization. The flaw is categorized under [CWE-502] Deserialization of Untrusted Data. Successful exploitation causes high impact to availability, allowing an attacker to disrupt the WebSphere server without requiring authentication or user interaction. Confidentiality and integrity are not directly affected according to the published metrics.
Critical Impact
An unauthenticated adjacent-network attacker can trigger a denial-of-service condition against IBM WebSphere Application Server through unsafe deserialization in the Name Service component.
Affected Products
- IBM WebSphere Application Server 9.0
- IBM WebSphere Application Server 8.5
- Deployments exposing the Name Service to adjacent networks
Discovery Timeline
- 2026-09-18 - CVE-2026-11711 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-11711
Vulnerability Analysis
The vulnerability resides in the Name Service component of IBM WebSphere Application Server. The Name Service handles JNDI and CORBA naming operations and accepts serialized Java objects from clients. When the component processes an attacker-supplied object stream, it invokes deserialization logic without adequately restricting the classes that may be reconstructed. This behavior aligns with the [CWE-502] Deserialization of Untrusted Data weakness.
An attacker on the same broadcast domain or otherwise adjacent network segment can reach the Name Service listener and submit a malicious payload. Processing that payload consumes server resources or triggers an unhandled exception path that halts the application server process. The EPSS probability is 0.376%, indicating low observed exploitation activity at the time of publication.
Root Cause
The root cause is the lack of a strict allow-list for classes that the Name Service will deserialize. Java's ObjectInputStream reconstructs any class available on the classpath unless a filter is applied. Without such a filter, a crafted serialized graph can invoke gadget chains that exhaust memory, spin CPU, or throw unrecoverable errors during object reconstitution.
Attack Vector
Exploitation requires network reachability to the WebSphere Name Service port from an adjacent network. The attacker does not need credentials or user interaction. The attacker sends a crafted serialized object to the Name Service endpoint, which then deserializes it and reaches a code path that terminates or destabilizes the server. Refer to the IBM Support Page for Node 7286610 for vendor-specific technical details.
No public exploit code, proof-of-concept, or CISA KEV entry exists for this CVE at the time of writing.
Detection Methods for CVE-2026-11711
Indicators of Compromise
- Unexpected WebSphere Application Server crashes or JVM terminations tied to Name Service activity.
- SystemOut.log or SystemErr.log entries showing java.io.InvalidClassException, ClassNotFoundException, or unhandled OutOfMemoryError during ORB or JNDI operations.
- Inbound connections to the Name Service bootstrap port from unexpected adjacent hosts.
Detection Strategies
- Monitor WebSphere logs for repeated deserialization exceptions originating from the Name Service handler.
- Baseline normal client sources for the Name Service and alert on connections from hosts outside that baseline.
- Use network telemetry to detect large or malformed serialized Java payloads (0xACED0005 header) targeting WebSphere ports.
Monitoring Recommendations
- Forward WebSphere application and system logs to a centralized platform for correlation with network events.
- Track JVM process restart frequency and application availability metrics as a proxy for exploitation attempts.
- Alert on repeated short-lived TCP sessions to the Name Service port followed by process termination.
How to Mitigate CVE-2026-11711
Immediate Actions Required
- Apply the fixes referenced in the IBM Support Page for Node 7286610 to all WebSphere Application Server 9.0 and 8.5 instances.
- Inventory all WebSphere deployments and identify Name Service ports exposed beyond required client subnets.
- Restrict adjacent-network access to Name Service endpoints using host firewalls and network ACLs.
Patch Information
IBM has published remediation guidance for CVE-2026-11711 at the IBM Support Page for Node 7286610. Administrators should apply the fix pack or interim fix that matches their installed WebSphere version and verify the deserialization filter is active after patching.
Workarounds
- Configure a Java deserialization filter (jdk.serialFilter) that allow-lists only classes required by the Name Service.
- Segment WebSphere management and naming interfaces onto a dedicated administrative network.
- Disable or firewall the Name Service listener where JNDI/CORBA naming from external clients is not required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.