IBM WebSphere Application Server 9.0.0 and 8.5.0 can be exploited by a remote attacker through an unsafe deserialization process that allows the attacker to read sensitive information from the system. The flaw is a classic case of exposed sensitive data to an unauthorized actor (CWE-532). The description does not explicitly state whether authentication is required, so it is unclear if the vulnerability can be exploited without credentials.

The vulnerability affects IBM WebSphere Application Server versions 8.5.0.0 through 8.5.5.30 and 9.0.0.0 through 9.0.5.28. Upgrading to at least fix pack 8.5.5.31 or 9.0.5.29—or applying the interim fix PH72166—removes the exposed deserialization code and stops the information leak.

The CVSS score of 7.4 demonstrates a high impact to confidentiality. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. The likely attack vector is a remote attacker sending a crafted serialized object to a vulnerable component; the description does not explicitly state the exact component, but unsafe deserialization patterns strongly imply exploitation of a deserialization routine exposed to network traffic.