IBM WebSphere Application Server CVE-2026-9311: Brief Summary of a Critical RCE via Security Control Bypass

Introduction

A critical code injection vulnerability in IBM WebSphere Application Server lets unauthenticated remote attackers bypass security controls and execute arbitrary code, and the damage may reach resources beyond the WebSphere process boundary itself. About 2,819 verified companies run WebSphere Application Server across enterprise and government sectors, and IBM confirms that no workarounds exist. Any organization still running versions 8.5 or 9.0 needs to act on this immediately.

The CVSS 9.0 rating is only part of what makes CVE-2026-9311 notable. It also continues a pattern. This is the third critical RCE vulnerability scoring 9.0 or higher to affect these same WebSphere versions in three of the last four years, following CVE-2023-23477 (CVSS 9.8) and CVE-2025-36038 (CVSS 9.0). CVE-2026-9311 has exactly the same CVSS vector string as CVE-2025-36038, which suggests the attack surface and impact profile are largely unchanged despite earlier remediation.

Technical Information

Root Cause: CWE-94 Code Injection via Security Control Bypass

CVE-2026-9311 is classified under CWE-94: Improper Control of Generation of Code ("Code Injection"). This weakness class occurs when a product builds all or part of a code segment from externally influenced input supplied by an upstream component, but fails to neutralize, or incorrectly neutralizes, special elements that could change the syntax or behavior of the intended code.

In this class of flaw, an attacker injects control-plane data into the user-controlled data plane and changes how the process executes. Where other vulnerability classes need additional conditions to reach code execution, injection flaws of this type only need the interpreter to parse the injected data. That is why they are so dangerous.

IBM's security bulletin describes the vulnerability as remote code execution "caused by the bypass of security controls." The wording indicates that WebSphere has protective mechanisms meant to restrict code generation or execution, and that those mechanisms were circumvented, letting attacker-controlled input influence how code is built and executed.

CVSS v3.1 Vector Breakdown

The full CVSS v3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, which breaks down as follows:

High attack complexity means successful exploitation depends on conditions outside the attacker's control, such as specific server configurations, deployed applications, or timing. That may slow initial exploit development. But Privileges Required and User Interaction are both None, so any unauthenticated remote attacker can launch the attack without a victim doing anything.

Scope: Changed is the most consequential metric here. Exploitation can spread beyond the WebSphere process boundary to other system components, which could enable lateral movement inside enterprise environments. That fits how code injection vulnerabilities behave in general. The injected code can reach resources the attacker is otherwise blocked from, which lets the attacker bypass protection mechanisms, gain privileges or assume an identity, execute unauthorized commands, and hide their activity.

CWE-94 in Context

CWE-94 belongs to a larger family of injection weaknesses. It is a child of CWE-74 (Injection) and CWE-913 (Improper Control of Dynamically Managed Code Resources), and a parent of CWE-95 (Eval Injection), CWE-96 (Static Code Injection), and CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine).

Associated CAPEC attack patterns include:

MITRE rates the likelihood of exploit for CWE-94 as Medium. In WebSphere, with a CVSS 9.0 score, the practical risk is significantly higher.

Co-Disclosure with CVE-2026-9330

The same IBM security bulletin (node/7274733) covers CVE-2026-9330, another remote code execution vulnerability. Two independent RCE flaws in one bulletin suggest either that a coordinated audit found several issues or that the security architecture of these WebSphere versions has more than one exploitable path. The same fix packs, tied to APAR PH71453, fix both vulnerabilities.

Remediation: No Workarounds, Patch Only

IBM has stated explicitly that no workarounds or mitigations are available for this vulnerability. The only remediation is to apply the specified fix packs or interim fixes:

Treat the interim fix as a temporary measure until you can apply the full fix pack.

Defense in Depth While Patching

With no workarounds available, organizations should put layered defenses in place while they deploy patches:

1. Isolate WebSphere Application Server instances from untrusted networks with firewalls and micro-segmentation, shrinking the attack surface for the network-accessible vector.
2. Prioritize CVE-2026-9311 remediation over other maintenance work, given the CVSS 9.0 score and the lack of workarounds.
3. Deploy intrusion detection and prevention systems to spot potential exploitation attempts against the code injection vector.
4. Patch CVE-2026-9330 at the same time. It is another RCE vulnerability in the same security bulletin, so make sure your patching covers both CVEs.

Affected Systems and Versions

The following IBM WebSphere Application Server versions are affected:

• IBM WebSphere Application Server 9.0: Versions 9.0.0.0 through 9.0.5.28
• IBM WebSphere Application Server 8.5: Versions 8.5.0.0 through 8.5.5.29

The fix is delivered through:

• Fix Pack 9.0.5.29 or later (for the 9.0 line)
• Fix Pack 8.5.5.30 or later (for the 8.5 line)
• Interim Fix for APAR PH71453 (for both lines, as a temporary measure)

Organizations running any version in these ranges should treat patching as an emergency. NVD published the record on June 1, 2026, and has marked it for NVD enrichment. It has no CVSS v4.0 score yet, so the severity assessment may change.

Vendor Security History

IBM WebSphere Application Server versions 8.5 and 9.0 have built up a concerning record of critical RCE vulnerabilities in recent years:

Deserialization and code injection have clearly been persistent attack vectors in WebSphere AS 8.5 and 9.0 across multiple years. CVE-2026-9311 and CVE-2025-36038 share an identical CVSS vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), which suggests similar underlying weaknesses in the security architecture of these product versions.

SentinelOne documented CVE-2023-23477 as a vulnerability that could allow "an unauthenticated attacker to achieve complete system compromise." The New York State Office of Information Technology Services issued advisory 2020-081 warning specifically that WebSphere RCE vulnerabilities could be used to "gain access to the underlying operating system."

Three critical RCE vulnerabilities scoring 9.0 or higher in the same product versions, in three of the last four years, make it fair to ask whether the security hardening applied between disclosures treats symptoms rather than root causes. Organizations running WebSphere AS 8.5 or 9.0 should patch this CVE and also weigh whether continued reliance on these product versions is an acceptable long-term risk. Migrating to WebSphere Application Server Liberty or an alternative platform may be worth considering as a longer-term strategy.

References

• NVD: CVE-2026-9311
• IBM Security Bulletin: IBM WebSphere Application Server is affected by remote code execution (CVE-2026-9311, CVE-2026-9330)
• CWE-94: Improper Control of Generation of Code ('Code Injection')
• IBM Security Bulletin: CVE-2025-36038 (Prior WebSphere RCE)
• SentinelOne: CVE-2023-23477 IBM WebSphere Application Server RCE Flaw
• CISA Known Exploited Vulnerabilities Catalog
• NYS ITS Advisory 2020-081: IBM WebSphere Application Server RCE
• HKCERT: IBM WebSphere Products Multiple Vulnerabilities (May 2026)
• Companies using IBM WebSphere Application Server (Landbase)
• 6Sense: IBM WebSphere Application Server Market Share
• IBM Security Bulletins Overview