CVE-2026-9006: IBM WebSphere SSRF Vulnerability in Ajax Proxy

Technical summary

CVE-2026-9006 is an SSRF vulnerability (CWE-918) present in WebSphere Application Server 8.5 and 9.0 when the Ajax Proxy component is active. The flaw allows an unauthenticated attacker with network access to craft requests that the server will forward on their behalf to internal or external systems. Because the request originates from the trusted application server, recipient systems may grant access or disclose information they would otherwise deny to external actors. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects a high-impact confidentiality and integrity risk, moderated by the additional complexity required to exploit the configuration.

Business impact

An attacker exploiting this vulnerability can perform reconnaissance against internal network infrastructure, access restricted APIs, steal credentials or sensitive data from backend systems, or trigger unauthorized actions on services the application server can reach. Organizations relying on network isolation or firewall rules to protect internal systems may find those controls circumvented. The lack of availability impact (no denial of service) means the server remains operational, potentially extending the window before discovery.

Affected systems

WebSphere Application Server 8.5 and 9.0 are vulnerable on all supported operating systems, including IBM AIX, IBM i, IBM z/OS, Linux (with Linux kernel), and Microsoft Windows. The vulnerability only manifests when the Ajax Proxy is explicitly configured and enabled. Organizations running these versions with Ajax Proxy disabled or not in use are not at risk from this specific flaw.

Exploitability

The vulnerability is network-accessible and requires no authentication or user interaction, lowering the barrier to exploitation. However, the attacker must know or discover that Ajax Proxy is enabled and must understand the internal network topology or target systems to craft effective requests. The CVSS 'H' (High) complexity reflects that successful exploitation typically requires additional reconnaissance or system knowledge rather than a simple one-click attack.

Remediation

Apply security updates from IBM for WebSphere Application Server 8.5 and 9.0 as they become available. In the interim, organizations should disable the Ajax Proxy feature if it is not actively required for business operations. Network segmentation and access controls limiting the application server's ability to reach sensitive internal systems can reduce exploitability. Review Ajax Proxy configuration logs for evidence of unauthorized requests.

Patch guidance

Check IBM's WebSphere Application Server security advisories for patched versions addressing CVE-2026-9006. Patches are typically released for supported versions; verify the specific patched version numbers in IBM's official security documentation. Test patches in a non-production environment before rollout, as WebSphere updates can affect application behavior. Prioritize systems with Ajax Proxy explicitly enabled in their configurations.

Detection guidance

Monitor network traffic from WebSphere Application Server for unexpected outbound connections to internal systems, particularly to ports associated with administrative interfaces, databases, or APIs. Enable detailed logging for Ajax Proxy requests and review logs for patterns of sequential or suspicious requests. Hunt for HTTP requests with unusual Host headers, file:// URIs, or localhost/127.0.0.1 references within application logs. Consider implementing network-based detection to flag requests originating from application server IPs to unexpected internal destinations.

Why prioritize this

CVE-2026-9006 merits immediate attention for organizations running affected WebSphere versions with Ajax Proxy enabled. The high confidentiality and integrity impact, combined with network accessibility and lack of authentication requirements, creates significant risk. Although the vulnerability is not yet in the CISA Known Exploited Vulnerabilities catalog, the straightforward nature of SSRF attacks and the widespread deployment of WebSphere mean exploitation is likely if the flaw becomes public. Organizations should treat this as a priority patch.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) reflects a critical combination of factors: unauthenticated network access (AV:N, PR:N) makes the attack surface large; the only mitigating complexity (AC:H) acknowledges that the attacker must overcome some environmental hurdles; the result is high impact on confidentiality and integrity (C:H, I:H), allowing information disclosure and unauthorized actions. The absence of availability impact (A:N) prevents a critical rating but does not diminish the severity for organizations defending against data theft or lateral movement.

Frequently asked questions