What’s Vulnerable › Vulnerabilities

CVE-2026-9072: WebSphere Application Server Remote Code Execution

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-22 · updated 2026-10-25
• Weakness: CWE-94

Description

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.

Affected products

• IBM i: from 7.3 through 7.6

References

• https://www.ibm.com/support/pages/node/7276560

Get alerted when CVE-2026-9072 or the next vulnerability affects your stack