IBM WebSphere Application Server CVE-2026-9330: SAML SSO Deserialization Leading to Remote Code Execution

Introduction

A deserialization flaw in IBM WebSphere Application Server's SAML Web Single Sign-On component lets a low-privilege authenticated attacker achieve remote code execution. The attacker injects a crafted serialized Java object into a client-side cookie that the server blindly trusts. CVE-2026-9330 (CVSS 8.5) lands on a well-worn attack surface. WebSphere has 456 tracked CVEs and public exploit tooling for earlier deserialization vulnerabilities in the same product, so exploit development for this one is a matter of time.

Technical information

Root cause: CWE-502 Deserialization of Untrusted Data

CVE-2026-9330 is classified under CWE-502: Deserialization of Untrusted Data, a weakness on the CWE Top 25 Most Dangerous Software Weaknesses list. It affects IBM WebSphere Application Server traditional versions 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.29. The flaw comes from improper validation of user-supplied data during deserialization in the SAML Web Single Sign-On component. According to the NVD description, this "could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain."

The SAML SSO cookie deserialization mechanism

Oligo Security's research into the closely related CVE-2026-1561, which affects WebSphere Liberty, describes a mechanism that likely applies to CVE-2026-9330 in the traditional WAS product. SAML Web SSO serializes a Java InitialRequest object and stores it client-side in a browser cookie named WASInitialRequest_<relayState>. When the server processes the SAML authentication flow, it reads the cookie and deserializes it with ObjectInputStream.readObject().

The vulnerable digestInitialRequestCookieValue() method sits in the InitialRequestUtil class, inside the com.ibm.ws.security.saml.websso.2.0_1.0.108.jar file. The critical implementation flaw is a misuse of String.concat(). The code calls concat() to append a server-side secret to the data being hashed, then ignores the return value. Java String objects are immutable, so concat() returns a new string and leaves the original unchanged. With the return value discarded, the "server-only secret" meant to prevent cookie forgery never takes part in the digest computation, and the integrity check is completely ineffective.

CVSS vector breakdown

The CVSS v3.1 vector for CVE-2026-9330 is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H (score 8.5):

Of these, the Changed scope stands out. Because the vulnerability targets the SAML SSO component, a successful exploit can cascade beyond the WebSphere server itself into the broader federated identity ecosystem.

Attack flow

Exploitation proceeds in five steps:

1. The attacker identifies a WebSphere Application Server instance with SAML Web SSO enabled, reachable over the network.

2. The attacker obtains low-privilege authenticated access to the application (PR:L). This could be any valid user account.

3. The attacker crafts a malicious WASInitialRequest_<relayState> cookie containing a serialized Java object. The cookie's integrity check is bypassed, because the String.concat() flaw means the server secret is never included in the digest, so the attacker can compute valid digests for arbitrary cookie values.

4. The attacker builds the serialized object as a gadget chain: a sequence of classes already present on the WebSphere classpath whose deserialization callbacks (readObject, readResolve, etc.) chain together to achieve arbitrary code execution.

5. The attacker sends the crafted HTTP request to the SAML SSO endpoint. The server deserializes the cookie via ObjectInputStream.readObject(), which triggers the gadget chain and executes arbitrary code on the server.

The attack complexity is rated High (AC:H) specifically because the attacker must identify and construct a working gadget chain from the classes available on the target server. Public tooling and research lower that barrier substantially.

Existing exploit tooling for WebSphere deserialization

Public exploit code already exists for similar WebSphere deserialization vulnerabilities, and it makes an exploit for CVE-2026-9330 significantly easier to build:

• Rapid7 hosts a Metasploit module (exploit/windows/misc/ibm_websphere_java_deserialize) that exploits unsafe deserialization of unauthenticated Java objects in WebSphere.
• A second Metasploit module (exploit/windows/ibm/ibm_was_dmgr_java_deserialization_rce) targets the Deployment Manager component.
• A detailed technical writeup titled "Shells and Soap: Websphere Deserialization to RCE" walks step-by-step through exploiting WebSphere deserialization, including SOAP-based deserialization paths and gadget chain construction.

Dual vulnerability bulletin

IBM published CVE-2026-9330 alongside CVE-2026-9311 (CVSS 9.0, CWE-94 code injection) in the same security bulletin. Both affect WebSphere traditional V9.0 and V8.5, so those server versions have two distinct RCE pathways. The same interim fix (APAR PH71453) resolves both vulnerabilities.

Affected systems and versions

The following IBM WebSphere Application Server traditional versions are affected:

The vulnerability requires the SAML Web Single Sign-On feature to be enabled. Deployments without SAML SSO configured are not exposed to this particular attack vector.

IBM explicitly states that no workarounds or mitigations are available. The only remediation is applying the interim fix (APAR PH71453) or the permanent fix packs when they become available in 3Q2026. Organizations that cannot apply the interim fix immediately should consider disabling the SAML Web SSO feature where operationally feasible, restricting network access to WebSphere servers, and tightly controlling low-privilege account access.

Vendor security history

OpenCVE tracks 456 CVEs for IBM WebSphere Application Server, and deserialization vulnerabilities recur throughout that history:

Other 2026 WebSphere vulnerabilities include CVE-2026-3621 (identity spoofing in Liberty), CVE-2026-8633 (RCE in Web Server Plug-ins), and CVE-2026-8620 (HTTP request smuggling in Web Server Plug-ins). The Oligo Security research that discovered CVE-2026-1561 identified seven distinct flaws in WebSphere Liberty, which together open multiple pathways to privilege escalation and remote code execution.

Deserialization vulnerabilities have recurred in this product line across multiple years (CVE-2020-4589, CVE-2026-1561, CVE-2026-9330). Each involves the same fundamental weakness of deserializing attacker-controlled data without adequate validation, which suggests an architectural root cause rather than a one-off coding error. The String.concat() flaw in the SAML SSO cookie integrity check is a clear example, a subtle implementation mistake that completely negates a security control.

This vulnerability class has drawn government-level attention before. In June 2020, the New York State Office of Information Technology Services issued advisory 2020-081 warning specifically about WebSphere deserialization risks.

References

• NVD: CVE-2026-9330
• IBM Security Bulletin: WebSphere Application Server RCE (CVE-2026-9311, CVE-2026-9330)
• IBM WebSphere Application Server and IBM HTTP Server Security Bulletin List
• CWE-502: Deserialization of Untrusted Data
• Oligo Security: New Vulnerabilities in IBM WebSphere Liberty
• Rapid7: IBM WebSphere RCE Java Deserialization Vulnerability (Metasploit)
• Rapid7: IBM WebSphere Deployment Manager Java Deserialization RCE (Metasploit)
• Shells and Soap: WebSphere Deserialization to RCE
• OpenCVE: WebSphere Application Server Vulnerabilities
• NYS ITS Advisory 2020-081: WebSphere Application Server RCE
• IBM Security Bulletin: CVE-2026-1561 (WebSphere Liberty SAML SSO)
• SentinelOne: CVE-2020-4589 WebSphere Application Server RCE
• Exploit-DB: IBM WebSphere Application Server Network Deployment