A remote attacker can exploit unsafe deserialization of untrusted data within IBM WebSphere Application Server 8.5 and 9.0 traditional to execute arbitrary code. The vulnerability also includes a cross‑site scripting component, but the primary consequence, as described, is the ability to run malicious code on the server. By sending a crafted object through a vulnerable deserialization point, an attacker can gain full control over the application server, compromising confidentiality, integrity, and availability of the affected system.

Vendors affected are IBM WebSphere Application Server for both the 8.5 and 9.0 traditional releases. All versions from 8.5.0.0 through 8.5.5.30 are vulnerable, and versions from 9.0.0.0 through 9.0.5.28 are also susceptible. Affected builds can be identified by the product names WebSphere Application Server 8.5 and 9.0, including any sub‑versions within those ranges.

The vulnerability scores a CVSS score of 8.1, indicating high severity. EPSS indicates an exploitation probability of less than 1%, suggesting that the likelihood of real‑world exploitation is low at present, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote through the web interface or other network access points that accept serialized data; an attacker would need to send a crafted payload to a deserialization endpoint to achieve code execution. Because the flaw arises from unsafe handling of untrusted data, it does not require local privileges or additional authentication.