Executive brief
IBM WebSphere Application Server is a widely-used Java application server that runs business-critical enterprise applications. This vulnerability allows an authenticated attacker to make unauthorized network requests from the server to internal or external systems by exploiting improper handling of SOAP requests. An attacker could use this to access restricted internal services, exfiltrate data, or pivot to other systems on the corporate network.
Technical details
The vulnerability is a blind server-side request forgery (SSRF) in IBM WebSphere Application Server versions 8.5 and 9.0 that arises from insufficient validation of SOAP request processing. The flaw allows an authenticated attacker (CWE-918) to craft malicious SOAP requests that cause the server to make arbitrary HTTP requests to internal or external targets without the attacker's direct network access. The attack requires valid credentials and network access to the WebSphere SOAP endpoint. Patches are available in versions 9.0.5.29 and later, and 8.5.5.31 and later.
Affected products
- IBM WebSphere Application Server 8.5, 9.0
Timeline
- 2026-09-14: disclosed