First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-9006

CriticalCVSS 9.1/10Last modified Oct 25, 2026

Description

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
IBM	WebSphere Application Server	>= 9.0, <= 7.0.2 Interim Fix 035; >= 8.5.0, <= 7.0.3 Interim Fix 017

References

https://www.ibm.com/support/pages/node/7276600Vendor Advisory

Timeline

Published: Jun 22, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-90060In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Don't add invalid kcontrols to LED layer The kcontrol L CVE-2026-90061In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip double clone set expressions on element inse CVE-2026-900627.1In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: move hardware offload step after building the cha CVE-2026-90063In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gso_segs The user c CVE-2026-90064In the Linux kernel, the following vulnerability has been resolved: drm/xe: Reject page faults from non-fault-mode scratch VMs Having scra CVE-2026-90065In the Linux kernel, the following vulnerability has been resolved: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation f CVE-2026-90066In the Linux kernel, the following vulnerability has been resolved: samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-mo CVE-2026-900677.5In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenge CVE-2026-90068In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The snd_so CVE-2026-900697.8In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - allocate async request context when cloning ACOMP_REQU CVE-2026-90075.5Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows ref CVE-2026-90070In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Return zero on status read failure st33zp24_status() ig