CVE-2026-9319: IBM WebSphere Application Server RCE Flaw

CVE-2026-9319 Overview

CVE-2026-9319 is an insecure deserialization vulnerability [CWE-502] affecting IBM WebSphere Application Server versions 9.0 and 8.5. The flaw resides in JAX-WS endpoints configured with WS-Security, where untrusted serialized Java objects are processed without adequate validation. A remote, unauthenticated attacker can craft malicious SOAP messages to trigger arbitrary code execution on the server. The vulnerability impacts confidentiality, integrity, and availability, and can pivot to adjacent components within the application server scope.

Critical Impact

Successful exploitation grants remote code execution on the underlying WebSphere host without authentication, enabling full server compromise.

Affected Products

• IBM WebSphere Application Server 9.0
• IBM WebSphere Application Server 8.5
• Applications exposing JAX-WS endpoints with WS-Security on the above versions

Discovery Timeline

• 2026-06-01 - CVE-2026-9319 published to the National Vulnerability Database (NVD)
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-9319

Vulnerability Analysis

The vulnerability stems from unsafe deserialization of attacker-controlled data inside JAX-WS web service endpoints protected by WS-Security. WebSphere's WS-Security handlers process inbound SOAP headers and message bodies that may contain serialized Java objects. When these objects are deserialized without strict type filtering, an attacker can supply a gadget chain that executes arbitrary code during object reconstruction. Because JAX-WS endpoints are typically network-reachable and WS-Security processes messages before application-level authentication completes, attackers do not need valid credentials. The scope change reflected in the CVSS vector indicates that exploitation can affect resources beyond the vulnerable component itself, including hosted applications and downstream services.

Root Cause

The root cause is the use of Java's native deserialization on untrusted SOAP message content within the WS-Security pipeline. No allow-list of permitted classes or look-ahead filtering is enforced before ObjectInputStream.readObject() reconstructs the payload, allowing arbitrary gadget chains from libraries on the classpath to execute.

Attack Vector

The attack vector is network-based. An attacker sends a specially crafted SOAP request to a JAX-WS endpoint exposing WS-Security processing. The malicious request contains a serialized Java object embedded in a security header or signed/encrypted element. When the server deserializes the object, a gadget chain leveraging classes available to the WebSphere runtime executes attacker-chosen commands under the application server process identity. Attack complexity is high because the attacker must identify a reachable endpoint and a viable gadget chain compatible with the deployed libraries, but no user interaction or privileges are required.

No verified public proof-of-concept code is available at this time. Refer to the IBM Support Page for technical details and remediation guidance.

Detection Methods for CVE-2026-9319

Indicators of Compromise

• Unexpected java.io.ObjectInputStream deserialization errors or ClassNotFoundException entries in WebSphere SystemOut.log or FFDC logs near SOAP request handling.
• Outbound network connections, shell processes, or java child processes originating from the WebSphere JVM following inbound SOAP traffic.
• SOAP requests to JAX-WS endpoints containing oversized or base64-encoded binary blobs within WS-Security headers.

Detection Strategies

• Inspect HTTP/HTTPS traffic to JAX-WS endpoints for SOAP envelopes containing serialized Java markers (for example, the rO0AB base64 prefix or the 0xac 0xed 0x00 0x05 magic bytes).
• Enable Java Security Manager auditing or JVM deserialization filters (jdk.serialFilter) and alert on rejected classes from common gadget libraries such as Commons Collections, ROME, and Hibernate.
• Correlate web server access logs with process creation events on the host to identify SOAP requests immediately preceding anomalous child process spawning.

Monitoring Recommendations

• Forward WebSphere FFDC, SystemOut.log, and SystemErr.log to a centralized logging platform and build alerts for deserialization stack traces.
• Monitor for unusual command execution, file writes to installedApps directories, and new listening sockets opened by the WebSphere process.
• Track outbound connections from WebSphere hosts to non-business destinations, which often indicate post-exploitation callbacks.

How to Mitigate CVE-2026-9319

Immediate Actions Required

• Apply the IBM-provided interim fix or fix pack for WebSphere Application Server 9.0 and 8.5 as documented on the IBM Support Page.
• Inventory all deployed applications exposing JAX-WS endpoints with WS-Security policies and restrict their exposure to trusted networks until patched.
• Audit recent SOAP traffic and WebSphere logs for indicators of prior exploitation attempts.

Patch Information

IBM has published remediation guidance and fixes for WebSphere Application Server 9.0 and 8.5. Administrators should consult the IBM Support Page for the specific interim fix identifier and fix pack level applicable to their deployment, and apply it during the next available maintenance window.

Workarounds

• Configure JVM-level deserialization filtering using jdk.serialFilter to restrict permitted classes to a minimal allow-list.
• Disable or remove JAX-WS endpoints with WS-Security that are not required for business operations.
• Place a web application firewall or API gateway in front of WebSphere to block SOAP requests containing Java serialization signatures until the patch is applied.

# Example JVM deserialization filter for WebSphere generic JVM arguments
-Djdk.serialFilter="!org.apache.commons.collections.functors.*;!org.codehaus.groovy.runtime.*;!com.sun.rowset.JdbcRowSetImpl;java.base/*;!*"