Description
IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.
Published: 2026-07-30
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM WebSphere Application Server 9.0 and 8.5 are affected by a remote code execution vulnerability located in the SOAP/JMX connector. The flaw permits an attacker to deliver crafted requests to the connector, resulting in execution of arbitrary code within the WebSphere process accounting for the process privileges.

Affected Systems

IBM WebSphere Application Server versions 8.5.0.0 through 8.5.5.29 and 9.0.0.0 through 9.0.5.28. The recommended approach is to upgrade to the minimal fix pack levels required by the interim fix and then apply Interim Fix PH71714, or to apply Fix Pack 9.0.5.29 or later for the 9.0 line or Fix Pack 8.5.5.30 or later for the 8.5 line.

Risk and Exploitability

The CVSS score of 8.5 signifies high severity. The EPSS score of 0.00337 (less than 1%) indicates a very low exploitation probability, yet the vulnerability is remotely accessible over the network via the SOAP/JMX connector. It is not listed in the CISA KEV catalog and no public exploit has been reported, but the combination of high CVSS and remote attack vector warrants monitoring and timely remediation.

Generated by OpenCVE AI on August 4, 2026 at 11:41 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71714.  For IBM WebSphere Application Server traditional: For V9.0.0.0 through 9.0.5.28: · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71714 https://www.ibm.com/support/pages/node/7277462 --OR-- · Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).   For V8.5.0.0 through 8.5.5.29: · Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix that resolves PH71714 https://www.ibm.com/support/pages/node/7277462 --OR-- · Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026). Additional interim fixes may be available and linked off the interim fix download page.

OpenCVE Recommended Actions

  • Upgrade to the minimal required fix pack levels and apply Interim Fix PH71714 from the IBM support site.
  • Alternatively, install Fix Pack 9.0.5.29 or newer for WebSphere 9.0, or Fix Pack 8.5.5.30 or newer for WebSphere 8.5.
  • Disable the SOAP/JMX connector if it is not needed for your deployment to reduce the attack surface.
  • Regularly monitor IBM support for additional interim fixes and apply them promptly.

Generated by OpenCVE AI on August 4, 2026 at 11:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.
Title IBM WebSphere Application Server is affected by a remote code execution vulnerability
First Time appeared Ibm
Ibm websphere Application Server
Weaknesses CWE-502
CPEs cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm websphere Application Server
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Ibm Websphere Application Server
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-31T03:56:20.116Z

Reserved: 2026-06-08T02:21:39.261Z

Link: CVE-2026-11536

cve-icon Vulnrichment

Updated: 2026-07-30T19:28:08.883Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T20:16:52.140

Modified: 2026-08-05T20:31:02.323

Link: CVE-2026-11536

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T11:45:03Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data