Loading vulnerability…
Remote Code Execution via Security-Control Bypass in IBM WebSphere Application Server
CVE-2026-9311 is a code-injection vulnerability in IBM WebSphere Application Server traditional 9.0 and 8.5 caused by a bypass of security controls. The flaw permits remote code execution on affected deployments.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation provides remote code execution on the affected IBM WebSphere Application Server deployment and may affect resources beyond the vulnerable WebSphere process boundary.
If you can’t patch tonight, do this now.
No vendor-provided workaround or mitigation is available. Apply the applicable interim fix or upgrade to the fixed fix-pack level.
Patch, then assume compromise.
Apply the interim fix associated with APAR PH71453. Upgrade WebSphere Application Server traditional 9.0.0.0 through 9.0.5.28 to Fix Pack 9.0.5.29 or later when available, and upgrade 8.5.0.0 through 8.5.5.29 to Fix Pack 8.5.5.30 or later when available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.