CVE-2026-9319CWE-502

IBM WebSphere Application Server is affected by a remote code execution vulnerability

Critical · published June 1, 2026

CVSS v3.1
9.0
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00621 · 49.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-06-01T17:59Z
EPSS history
Timeline
  • 01 JUN 17:59Z
    IBM WebSphere Application Server is affected by a remote code execution vulnerability
    cvelistv5