CVE-2026-9006

No fix known EPSS <1%CVSS 7.4

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

Published 2026-06-22 · CVE record · OSV

Products: ibm websphere_application_server