CVE-2026-9006

CriticalCVSS 9.1/10Last modified Jun 24, 2026

Description

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Jun 22, 2026
Last modified
Jun 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-90060In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Don't add invalid kcontrols to LED layer The kcontrol LCVE-2026-90061In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip double clone set expressions on element inseCVE-2026-900627.1In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: move hardware offload step after building the chaCVE-2026-90063In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gso_segs The user cCVE-2026-90064In the Linux kernel, the following vulnerability has been resolved: drm/xe: Reject page faults from non-fault-mode scratch VMs Having scraCVE-2026-90065In the Linux kernel, the following vulnerability has been resolved: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation fCVE-2026-90066In the Linux kernel, the following vulnerability has been resolved: samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-moCVE-2026-900677.5In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messengeCVE-2026-90068In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The snd_soCVE-2026-900697.8In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - allocate async request context when cloning ACOMP_REQUCVE-2026-90075.5Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows refCVE-2026-90070In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Return zero on status read failure st33zp24_status() ig
CVE-2026-9006: Critical severity, CVSS 9.1 | Vulnix