The vulnerability is a pre‑authentication unsafe deserialization flaw in IBM WebSphere Application Server 8.5 and 9.0 traditional. An attacker that can send crafted serialized data to the application server can bypass authentication or trigger arbitrary code execution. Based on the description, it is inferred that the flaw can be triggered from any external interface that accepts serialized payloads. The impact is a full compromise of confidentiality, integrity, and availability of the affected application servers, as exacerbated by a CVSS score of 9.8.

IBM WebSphere Application Server 8.5 traditional, versions 8.5.0.0 through 8.5.5.30, and 9.0 traditional, versions 9.0.0.0 through 9.0.5.28. The affected components are all deployments of the traditional WebSphere Application Server product, as identified by the corresponding CPE strings.

The high CVSS score of 9.8 reflects the severity of gaining execution privileges. The EPSS score of less than 1 % indicates that the flaw is rarely exploited in the wild, but its absence from the KEV catalogue does not reduce its importance. Based on the description, it is inferred that the vulnerable endpoint is typically exposed. An attacker would simply need to send a malicious serialized object to the vulnerable endpoint. Once executed, the attacker gains the same privileges as the running application server, potentially allowing full control over the host.