IBM WebSphere Application Server 8.5 and 9.0 are vulnerable to improper validation of user-supplied data during deserialization in the SAML Web Single Sign-On component. The flaw allows an attacker to craft a malicious HTTP request that, when processed with a suitable gadget chain, results in remote code execution. This weakness can lead to full compromise of the affected server, including loss of confidentiality, integrity, and availability, and is classified as CWE‑502.

The affected environment is IBM WebSphere Application Server (traditional). Vulnerable versions include 9.0.0.0 through 9.0.5.28, and 8.5.0.0 through 8.5.5.29. Updating to fix pack 9.0.5.29 or later for 9.x, or to fix pack 8.5.5.30 or later for 8.5.x, resolves the issue.

The CVSS score is 8.5, indicating high severity. EPSS information is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via a crafted HTTP request to the server’s SAML endpoint, requiring the attacker to supply a malicious payload that triggers the gadget chain. An attacker who succeeds can execute arbitrary code on the server.