CVE-2026-9006

🗓️ 22 Jun 2026 14:46:47Reported by ibmType

IBM WebSphere Application Server versions nine point zero and eight point five have server-side forgery via the Ajax Proxy, enabling unauthorized requests.

Reporter	Title	Published	Views	Family All 18
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities have been identified in IBM WebSphere Application Server traditional, WebSphere Liberty profile, IBM HTTP Server its WebSphere plugins shipped with IBM Business Automation Workflow	18 Jun 202620:12	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability has been found in WebSphere Application Server shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)	3 Jul 202613:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server is affected by server-side request forgery	6 Jul 202620:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by a server-side request forgery vulnerability (CVE-2026-9006)	3 Jul 202600:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a server-side request forgery vulnerability (CVE-2026-9006)	3 Jul 202600:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server is affected by server-side request forgery (CVE-2026-9006)	30 Jun 202618:18	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM WebSphere Remote Server CVE-2026-9006	23 Jun 202615:58	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2026-10845, CVE-2026-8646, CVE-2026-9320, CVE-2026-9071 and CVE-2026-9006)	17 Jun 202617:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by server-side request forgery	18 Jun 202607:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a server-side request forgery vulnerability (CVE-2026-9006)	3 Jul 202600:11	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange8.5.0.0–8.5.5.30

ibm websphere_application_serverRange9.0.0.0–9.0.5.29

AND

ibm aixMatch-

ibm iMatch-

ibm z/osMatch-

linux linux_kernelMatch-

microsoft windowsMatch-

[
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server",
    "versions": [
      {
        "status": "affected",
        "version": "9.0",
        "lessThanOrEqual": "7.0.2 Interim Fix 035",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.5.0",
        "lessThanOrEqual": "7.0.3 Interim Fix 017",
        "versionType": "semver"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7276600

24 Jun 2026 05:17Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.4 - 9.1

EPSS0.00221

SSVC

CWE-918