Loading vulnerability…
Remote Code Execution in IBM WebSphere SAML Web SSO Deserialization
CVE-2026-9330 is a deserialization-of-untrusted-data vulnerability in the SAML Web Single Sign-On component of IBM WebSphere Application Server traditional 8.5 and 9.0. Improper validation of user-supplied data during deserialization permits a crafted HTTP request, combined with a suitable Java gadget chain, to trigger remote code execution. Affected releases include WebSphere traditional 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.29.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can provide remote code execution on the affected WebSphere Application Server. An attacker could execute code through the vulnerable SAML Web SSO deserialization path.
If you can’t patch tonight, do this now.
No vendor-provided workaround or mitigation is available. Until the applicable fix is deployed, reduce exposure by disabling SAML Web SSO where operationally feasible, restricting access to SAML SSO endpoints to trusted networks, and tightly controlling low-privilege accounts.
Patch, then assume compromise.
Apply the interim fix for APAR PH71453. Upgrade WebSphere Application Server traditional 9.0 to Fix Pack 9.0.5.29 or later, and WebSphere Application Server traditional 8.5 to Fix Pack 8.5.5.30 or later when available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.