CVE-2026-9667
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CWE
- CWE-918
- Published
- 2026-09-10
- Last modified
- 2026-09-10
Affected products
- IBM WebSphere Application Server
- IBM WebSphere Application Server
Weakness type
Related vulnerabilities
- CVE-2026-54054 — Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects
- CVE-2026-79723 — Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- CVE-2026-81207 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-81213 — Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- CVE-2026-81265 — Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- CVE-2026-82097 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-88056 — Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
- CVE-2026-89049 — Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent