IBM WebSphere Application Server CVE-2026-9319: Brief Summary of Critical RCE via JAX-WS Deserialization

Introduction

CVE-2026-9319 is a critical remote code execution vulnerability in IBM WebSphere Application Server. It carries a CVSS 9.0 score, it has no available workarounds, and it affects enterprises running JAX-WS web services with WS-Security. The flaw is an insecure deserialization in the WS-Security processing pipeline, a code path that has been a recurring source of security flaws in WebSphere. Its CVSS vector also carries a scope change, so successful exploitation can reach beyond the compromised component into adjacent systems.

Technical information

Root cause: CWE-502 Deserialization of Untrusted Data

The vulnerability is in how IBM WebSphere Application Server processes incoming data at JAX-WS (Java API for XML Web Services) endpoints configured with WS-Security. When the WebSphere runtime processes WS-Security elements in SOAP messages, it deserializes data without adequate type validation or restriction. An attacker can use this to inject malicious serialized Java objects.

CVSS 3.1 vector breakdown

The IBM Security Bulletin publishes the CVSS 3.1 vector string as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, for a base score of 9.0 (Critical).

Of these metrics, the scope change (S:C) has the largest operational consequence. Exploiting the WebSphere JAX-WS endpoint can affect resources governed by a different security authority than the vulnerable component, which widens the blast radius of a successful attack.

The high attack complexity (AC:H) suggests that exploitation is not trivial. Specific conditions must be met. Those likely include WS-Security being configured in a particular way on the target endpoint, and the attacker knowing which gadget chains are available in that server's configuration.

Attack flow

Exploitation follows the well-established Java deserialization attack pattern:

1. Reconnaissance: The attacker identifies exposed JAX-WS endpoints with WS-Security enabled on a target WebSphere server. These endpoints are common in enterprise SOA deployments.

2. Payload construction: The attacker builds a specially crafted SOAP message with a malicious serialized Java object in the WS-Security header or message body.

3. Deserialization trigger: When the WebSphere runtime processes the WS-Security elements of the incoming SOAP message, it deserializes the untrusted data without adequate type validation or restriction.

4. Code execution: The deserialized object triggers a gadget chain, which uses existing classes in the WebSphere classpath to execute arbitrary code on the server with the privileges of the WebSphere process.

This matches how prior WebSphere deserialization vulnerabilities have been exploited. The documented attack method for CVE-2025-36038 was to find exposed WebSphere Application Server endpoints that accept serialized Java objects, then send them malicious serialized payloads whose gadget chains use existing classes in the server's classpath to execute arbitrary code.

Prior JAX-WS WS-Security vulnerability

APAR PM86026 addressed a WS-Security XML digital signature vulnerability that affected IBM WebSphere users of WS-Security-enabled JAX-WS applications. That earlier flaw let a network attacker spoof message signatures by sending a specially crafted SOAP message. CVE-2026-9319 targets the same general code path, but it exploits deserialization instead of signature validation. It is a different class of attack against the same subsystem.

NVD assessment status

As of publication, the NVD has not yet provided its own CVSS assessment. The CVSS 4.0 score is listed as "NVD N/A", and no CPE configuration data has been published. The severity rating may be revised once NIST completes its independent analysis.

Affected systems and versions

The following IBM WebSphere Application Server versions are affected:

The vulnerable configuration requires JAX-WS endpoints with WS-Security enabled, which is common in enterprise SOA deployments.

Full fix packs (9.0.5.29 for V9.0 and 8.5.5.30 for V8.5) are targeted for Q3 2026. Until then, the only supported remediation is the Interim Fix for APAR PH71454. IBM explicitly states that no workarounds or mitigations are available.

Vendor security history

IBM WebSphere Application Server has had repeated deserialization vulnerabilities in the same version streams:

All four CVEs affect WebSphere 8.5 and 9.0, and CVE-2020-4589 also affected 7.0. A pattern that spans multiple years and code paths points to a systemic problem in how WebSphere handles deserialization. Organizations running these versions should consider broader defenses, such as evaluating a migration to WebSphere Liberty (which may not share the same vulnerable code paths for traditional JAX-WS) and adding runtime deserialization filtering at the JVM level where feasible.

Prior WebSphere deserialization CVEs with similar initial descriptions were later assigned CVSS 9.8 scores with low attack complexity once fully analyzed. The current AC:H rating for CVE-2026-9319 may be revised.

References

• NVD: CVE-2026-9319
• IBM Security Bulletin: IBM WebSphere Application Server is affected by a remote code execution vulnerability (CVE-2026-9319)
• CWE-502: Deserialization of Untrusted Data
• CVE-2025-36038: IBM WebSphere Application Server Insecure Deserialization
• CVE-2023-23477: IBM WebSphere Application Server Deserialization
• CVE-2020-4589: IBM WebSphere Application Server RCE Flaw
• Rapid7 Metasploit Module: IBM WebSphere RCE Java Deserialization
• IBM APAR PM86026: JAX-WS WS-Security Digital Signature Vulnerability
• NSFOCUS: WebSphere Application Server Remote Code Execution Vulnerability (CVE-2025-36038)
• NY State ITS: Vulnerability in IBM WebSphere Application Server
• Acunetix: IBM WebSphere RCE Java Deserialization Vulnerability
• OpenCVE: Vulnerabilities for WebSphere Application Server
• IBM Fix List for WebSphere Application Server V8.5