CVE-2026-9336 is a medium severity (6.5) denial of service in IBM WebSphere Application Server 9.0 and 8.5. A specially crafted HTTP request to an administrative endpoint can make the server use up filesystem space. The fix is Fix Pack 9.0.5.29 for 9.0 and 8.5.5.31 for 8.5.
What's affected
IBM's bulletin, published 8 September 2026, lists WebSphere Application Server 9.0 and 8.5 as affected, specifically 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.30. It says to apply Fix Pack 9.0.5.29 or 8.5.5.31, or a later fix pack, and describes their availability as September 2026. The bulletin lists no workarounds or mitigations. It covers several CVEs at once, so one fix pack closes all of them.
The weakness is CWE-306, missing authentication for a critical function. The record and the bulletin agree on a score of 6.5 and the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The attack vector is adjacent network, so the attacker needs to be on the same network segment, and no login is needed. Only availability is affected.
How to check if you're exposed
On the server, run the version tool from the product's bin directory:
./versionInfo.sh
The output lists the installed product and fix pack level. Compare it with 9.0.5.29 on the 9.0 line and 8.5.5.31 on the 8.5 line. Anything lower is in scope.
Inventory every WebSphere installation, including older test servers and ones managed by other teams. Note that the bulletin only covers supported versions, and says that leaving an unsupported version off its list is not a statement that it is unaffected.
Then check network placement. Administrative endpoints should only be reachable from management networks. If the admin port is open to a wide internal network or to the internet, the adjacent attacker in the vector is much easier to find. Also check disk monitoring and alerts on the volumes WebSphere writes to.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Plan and apply Fix Pack 9.0.5.29 or 8.5.5.31 (or later) following IBM's fix pack instructions, starting with internet-facing and production servers.
- Test the fix pack on a staging server first, since it is a cumulative update.
- Record the fix pack level for each server after patching.
- Subscribe to IBM's security bulletin notifications for WebSphere so the next one reaches you on the day it is published.
- Restrict access to administrative ports to management networks with firewall rules.
- Add alerts for fast growth in disk use on WebSphere volumes.
Why it matters
Administrative endpoints should require authentication, which is the point of the weakness label. IBM describes a request to such an endpoint that causes the server to exhaust filesystem space, which stops it from working and can disturb anything else on the same volume.
A full disk is a quiet failure: logs stop, databases and temp files fail and recovery can be slow. Network controls on administrative interfaces reduce the risk before a patch lands. The KEV flag in the record is false and the bulletin reports no exploitation.
Quick check
Does it need a login?
The vector says no privileges are required, and the weakness is missing authentication for a critical function.
Can a firewall alone fix it?
Limiting who can reach the admin port lowers the risk. IBM lists no workaround, so apply the fix pack.
Sources
Last reviewed: 18 October 2026.
