CVE-2026-9320

🗓️ 22 Jun 2026 14:53:36Reported by ibmType

IBM WebSphere Server and Liberty are vulnerable to denial of service via crafted requests causing memory exhaustion.

Reporter	Title	Published	Views	Family All 22
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by multiple vulnerabilities (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)	2 Jul 202623:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities	8 Jul 202613:06	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinses Automation Workflow (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)	29 Jun 202613:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities	18 Jun 202607:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities have been identified in IBM WebSphere Application Server traditional, WebSphere Liberty profile, IBM HTTP Server its WebSphere plugins shipped with IBM Business Automation Workflow	18 Jun 202620:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by multiple vulnerabilities (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)	3 Jul 202600:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM WebSphere Application Server and WebSphere Application Server Liberty shipped with IBM WebSphere Remote Server	23 Jun 202616:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by multiple vulnerabilities (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)	3 Jul 202600:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server is affected by HTTP request smuggling and a denial of service.	6 Jul 202620:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities within WebSphere Application Server Liberty, affect IBM Tivoli Monitoring.	30 Jun 202617:46	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange8.5.0.0–8.5.5.30

ibm websphere_application_serverRange9.0.0.0–9.0.5.29

ibm websphere_application_serverRange17.0.0.3–26.0.0.7liberty

AND

apple macosMatch-

ibm aixMatch-

ibm iMatch-

ibm z/osMatch-

linux linux_kernelMatch-

microsoft windowsMatch-

[
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.0",
        "lessThanOrEqual": "7.0.2 Interim Fix 035",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.5.0",
        "lessThanOrEqual": "7.0.3 Interim Fix 017",
        "versionType": "semver"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*"
    ]
  },
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server - Liberty",
    "versions": [
      {
        "status": "affected",
        "version": "17.0.0.3",
        "lessThanOrEqual": "26.0.0.6",
        "versionType": "semver"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.6:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7276579

23 Jun 2026 20:46Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.9 - 7.5

EPSS0.00323

SSVC

CWE-400