CVE-2026-9006 - Vulnerability Details - OpenCVE

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	Websphere Application Server

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://www.ibm.com/support/pages/node/7276600

History

Mon, 22 Jun 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.
Title		IBM WebSphere Application Server is affected by server-side request forgery
First Time appeared		Ibm Ibm websphere Application Server
Weaknesses		CWE-918
CPEs		cpe:2.3:a:ibm:websphere_application_server:8.5.0:::::::* cpe:2.3:a:ibm:websphere_application_server:8.5:::::::* cpe:2.3:a:ibm:websphere_application_server:9.0.0:::::::* cpe:2.3:a:ibm:websphere_application_server:9.0:::::::*
Vendors & Products		Ibm Ibm websphere Application Server
References		https://www.ibm.com/support/pages/node/7276600
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2026-06-22T14:46:47.768Z

Updated: 2026-06-22T14:46:47.768Z

Reserved: 2026-05-19T13:59:27.241Z

Link: CVE-2026-9006

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-06-22T16:30:08Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9006", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-05-19T13:59:27.241Z", "datePublished": "2026-06-22T14:46:47.768Z", "dateUpdated": "2026-06-22T14:46:47.768Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-06-22T14:46:47.768Z"}, "title": "IBM WebSphere Application Server is affected by server-side request forgery", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "WebSphere Application Server", "versions": [{"status": "affected", "version": "9.0", "lessThanOrEqual": "7.0.2 Interim Fix 035", "versionType": "semver"}, {"status": "affected", "version": "8.5.0", "lessThanOrEqual": "7.0.3 Interim Fix 017", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7276600", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71556.\n\n\n\nFor IBM WebSphere Application Server traditional:\n\n\n\nFor V9.0.0.0 through 9.0.5.28:\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71556 https://www.ibm.com/support/pages/node/7276400 \n--OR--\n\u00b7 Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).\u00a0\n\n\n\nFor V8.5.0.0 through 8.5.5.29:\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71556 https://www.ibm.com/support/pages/node/7276400 \n--OR--\n\u00b7 Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).\u00a0\n\n\n\n\n\n\n\nAdditional interim fixes may be available and linked off the interim fix download page.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71556.</p><p><strong>For IBM WebSphere Application Server traditional:</strong></p><p><strong>For V9.0.0.0 through 9.0.5.28:</strong><br>\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves <a href=\"https://www.ibm.com/support/pages/node/7276400\" rel=\"nofollow\">PH71556</a><br>--OR--<br>\u00b7 Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026). </p><p><strong>For V8.5.0.0 through 8.5.5.29:</strong><br>\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves <a href=\"https://www.ibm.com/support/pages/node/7276400\" rel=\"nofollow\">PH71556</a><br>--OR--<br>\u00b7 Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026). </p><p></p><p>Additional interim fixes may be available and linked off the interim fix download page.</p>"}]}], "x_generator": {"engine": "ibm-cvegen"}}}}