External risk intelligence

IBM WebSphere Application Server Deserialization Vulnerability via JAX-WS WS-Security

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-9319

IBM WebSphere Application Server is frequently deployed as a public-facing web or application server. JAX-WS endpoints are commonly exposed to provide web services, making the vulnerability reachable in many standard internet-facing web application deployments.

Deserialization

Ibm Websphere Application Server

8.5.0.0 to before 8.5.5.309.0.0.0 to before 9.0.5.29

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

IBM WebSphere Application Server has a vulnerability that could allow remote code execution if a specific type of data is processed. This issue arises from the way the application handles security-enabled web services. While the exploit requires specific conditions, the potential impact of remote code execution makes it a matter of significant concern for systems running this software.

Unsafe data handling allows remote code execution.
Critical for systems using IBM WebSphere Application Server.
Confirm relevance; assess potential business exposure.

Attack Path

How an attacker could exploit the issue

An attacker could initiate an attack by sending specially crafted data over the network to a vulnerable WebSphere Application Server. This data, when processed by JAX-WS endpoints that use WS-Security, can trigger a deserialization vulnerability, potentially allowing the attacker to execute arbitrary code on the server.

Network access to JAX-WS endpoints is required.
Untrusted data deserialization via WS-Security triggers vulnerability.
Risk of remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect sensitive information and system integrity when untrusted data is deserialized through JAX-WS endpoints with WS-Security enabled. This scenario may lead to remote code execution, impacting the confidentiality, integrity, and availability of the application server.

System data and configuration.
Untrusted data deserialization via JAX-WS.
Potential remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Addressing this critical vulnerability in IBM WebSphere Application Server likely involves application owners and infrastructure teams, with potential coordination through vendor management for fixes. The initial practical step is to identify all instances of the affected WebSphere versions, determine their exposure and business criticality, and confirm the accountable owner for remediation.

Application owners should manage the issue.
Verify JAX-WS endpoint exposure.
Plan remediation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM WebSphere Application Server?

IBM WebSphere Application Server is a software framework used to build, deploy, and run enterprise-level Java applications. It acts as a middle layer between a database and the user, managing transactions and providing a secure environment for web services. Many organizations rely on it to host complex, high-traffic business applications that communicate over a network.

What does CWE-502 mean for CVE-2026-9319?

CWE-502 refers to the deserialization of untrusted data. In simple terms, the software takes data sent by a user and converts it into objects within the server's memory without properly checking if that data is safe. Because CVE-2026-9319 allows this process to happen, an attacker could send malicious data that tricks the server into executing unauthorized commands.

How is this vulnerability triggered?

The vulnerability is triggered when a server processes specific, maliciously crafted data through JAX-WS endpoints that have WS-Security enabled. It does not occur if WS-Security is disabled for those endpoints, nor does it trigger when processing standard, non-malicious web traffic that lacks the specific attack payload required to manipulate the deserialization process.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a significant concern because IBM WebSphere Application Server is frequently deployed to face the internet. Since JAX-WS endpoints are often publicly reachable to provide necessary web services, they are accessible to potential attackers. Systems that are exposed to the public internet are therefore more likely to be reachable for this type of network-based attack.

What steps should I take if I run WebSphere?

First, create an inventory of all instances running WebSphere versions 8.5 or 9.0 to identify where the software is deployed. Check if your JAX-WS endpoints are configured with WS-Security enabled, as this is a core component of the vulnerability. Finally, coordinate with your infrastructure team to review official IBM security guidance and apply the necessary patches to protect your environment from potential remote code execution.

References

www.ibm.com/support/pages/node/7274738

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.