CVE-2026-9006 — IBM WebSphere Application Server is affected by server-side request forgery

CVE-2026-9006

IBM WebSphere Application Server is affected by server-side request forgery PUBLISHED

Description (CNA)

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

Affected (CNA)

Vendor / product	Versions
IBM / WebSphere Application Server	affected 9.0 through 7.0.2 Interim Fix 035; affected 8.5.0 through 7.0.3 Interim Fix 017

CWE

CWE-918

References

https://www.ibm.com/support/pages/node/7276600

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.