CVE-2026-9006 is a high severity (CVSS 7.4) server-side request forgery in IBM WebSphere Application Server 9.0 and 8.5 with the Ajax Proxy configured. IBM says to apply the interim fix for APAR PH71556 or fix pack 9.0.5.29 or 8.5.5.30, and to follow the extra manual steps after installing.
What's affected
IBM's bulletin lists WebSphere Application Server 9.0 and 8.5. The issue applies where the Ajax Proxy is configured. IBM's remediation for traditional WebSphere:
- V9.0.0.0 through 9.0.5.28: apply the interim fix for PH71556, or fix pack 9.0.5.29 or later
- V8.5.0.0 through 8.5.5.29: apply the interim fix for PH71556, or fix pack 8.5.5.30 or later
IBM targeted those fix packs for the third quarter of 2026, and lists no workarounds. IBM also says to follow the additional instructions in the interim fix after installing it. The bulletin history shows a manual step was added on 30 June 2026.
How to check if you're exposed
Check the WebSphere version with the product's version information tool, which IBM ships in the bin folder of the install. Then check whether the Ajax Proxy is configured. In the administrative console, look for the Ajax proxy configuration or its servlet mappings, or search the application server profile for the proxy servlet. If it is not configured, the described path does not exist, but the update is still advised.
What to do now
- Read the IBM bulletin and APAR PH71556.
- Apply the interim fix or fix pack 9.0.5.29 or 8.5.5.30 or later.
- Carry out the extra manual steps IBM lists after installation. The fix is not complete without them.
- Review whether the Ajax Proxy is needed, and disable it if it is not.
- Limit outbound network access of application servers to what they need.
Why it matters
The weakness is CWE-918 (server-side request forgery). A proxy that fetches web content on behalf of a client can be steered to places the client could not reach directly, such as internal services. IBM says the result can be a security bypass or information disclosure.
Egress control is the standard second layer. If the server can only reach approved destinations, a forged request has fewer places to go.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Is the interim fix enough?
IBM says to follow the additional instructions in the interim fix to complete the remediation. Do both.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
