CVE-2026-9322: 
IBM WebSphere Application Server vulnerability analysis and mitigation

CVE-2026-9322 is a denial-of-service (DoS) vulnerability in IBM WebSphere Application Server (WAS) and WebSphere Application Server Liberty, triggered by crafted HTTP requests. It affects IBM WebSphere Application Server versions 8.5.0.0 through 8.5.5.30 and 9.0.0.0 through 9.0.5.28, as well as IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7. The vulnerability was published on July 30, 2026, with IBM issuing its security bulletin around the same date. It carries a CVSS v3.1 base score of 7.5 (High) (IBM Advisory, GitHub Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the affected software fails to properly control the allocation and maintenance of limited resources when processing certain HTTP requests. An unauthenticated remote attacker can send a specially crafted HTTP request to an exposed WAS or Liberty endpoint, causing excessive resource consumption that degrades or halts service availability. No authentication, user interaction, or elevated privileges are required for exploitation, and the attack complexity is low. The vulnerability has been associated with CAPEC-147 (XML Ping of the Death) and CAPEC-492 (Regular Expression Exponential Blowup), suggesting the crafted request may exploit pathological input patterns in XML or regex processing (IBM Advisory, GitHub Advisory).

Successful exploitation results in a high availability impact, potentially causing the targeted WebSphere Application Server or Liberty instance to become unresponsive or crash, disrupting business-critical application services. There is no confidentiality or integrity impact — the vulnerability is limited to denial of service. Given that WAS is commonly deployed in enterprise environments hosting mission-critical workloads, prolonged service disruption could have significant operational consequences (IBM Advisory, GitHub Advisory).

As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no public proof-of-concept exploit code has been identified. The NVD SSVC assessment classifies exploitation as "none" and the attack as automatable, meaning a threat actor could script repeated requests at scale. The EPSS score is approximately 0.305% (23rd percentile), indicating a relatively low near-term exploitation probability. CVE-2026-9322 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time (GitHub Advisory, IBM Advisory).

IBM has released patched versions addressing this vulnerability: WebSphere Application Server 8.5 users should upgrade to 8.5.5.31 or later, WAS 9.0 users should upgrade to 9.0.5.29 or later, and WAS Liberty users should upgrade to 26.0.0.8 or later. IBM has published multiple security bulletins covering downstream products that bundle WAS or Liberty, including IBM Business Automation Workflow, IBM Cloud Pak for Applications, IBM Engineering Lifecycle Management products, and IBM Engineering Test Management — administrators of those products should consult the respective bulletins. Where immediate patching is not feasible, restricting network access to WAS HTTP endpoints via firewall rules or load balancer policies can reduce exposure (IBM Advisory, IBM Tivoli Advisory, Open Liberty Blog).

The vulnerability received limited but notable community attention, with a Reddit post in the r/pwnhub community highlighting the advisory shortly after publication. A Medium threat landscape roundup by Loginsoft also referenced CVE-2026-9322 in the context of the week's notable vulnerabilities. IBM issued several downstream security bulletins covering affected bundled products, reflecting the broad deployment footprint of WebSphere in enterprise environments. No significant independent researcher commentary or major media coverage has been identified beyond aggregator and vendor channels.