Loading vulnerability…
Remote code execution in IBM WebSphere JAX-WS WS-Security deserialization
CVE-2026-9319 is an untrusted-data deserialization vulnerability in IBM WebSphere Application Server JAX-WS endpoints configured with WS-Security. The WS-Security processing pipeline deserializes data from SOAP messages without adequate type validation or restriction, potentially allowing attacker-supplied serialized Java objects to trigger arbitrary code execution. Affected releases include 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.29 on AIX, IBM i, Linux, Windows, and z/OS.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary code execution on the affected server with the privileges of the WebSphere process. The extent of compromise depends on that process's permissions and access to other resources.
If you can’t patch tonight, do this now.
IBM identifies no vulnerability-specific workaround or mitigation. HCL deployment guidance recommends restricting network access to JAX-WS endpoints to trusted networks and disabling unnecessary exposed services where operationally possible. These measures reduce exposure but do not correct the deserialization flaw or replace patching.
Patch, then assume compromise.
Apply IBM's Interim Fix for APAR PH71454 for the installed WebSphere version. Full fix packs 9.0.5.29 and 8.5.5.30 were targeted for Q3 2026; verify their availability and applicability before upgrading. HCL Unica guidance explicitly recommends upgrading WebSphere to 8.5.5.30. For affected HCL VersionVault or DevOps Code ClearCase deployments, identify the WebSphere version used by the CCRC WAN server and apply the applicable IBM fix directly to that host; no VersionVault-specific steps are required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.