CVE-2026-9311Critical· 9.0▾ MidnightIBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 49.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.6%
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.
websphere_application_server >= 8.5.0.0, < 8.5.5.30websphere_application_server >= 9.0.0.0, < 9.0.5.29Upgrade past the affected range:
websphere_application_server 9.0.5.29Connected by shared product, vendor, weakness, or advisory.
CVE-2026-9176Medium· 6.7IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls
CVE-2026-9330High· 8.5IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component
CVE-2026-4410Medium· 4.8IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted …
CVE-2026-96119Critical· 9.9IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
CVE-2026-90920Critical· 9.8IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
CVE-2025-36099Medium· 4.9IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request