CVE-2026-9006 is a server-side request forgery (SSRF) vulnerability in IBM WebSphere Application Server 9.0 and 8.5.0 when the Ajax Proxy feature is enabled. This flaw allows attackers to make unauthorized requests originating from the vulnerable server, which may result in bypassing security controls or disclosing sensitive information. The vulnerability is classified under CWE-918 and has a CVSS v3.1 base score of 7.4, indicating high severity. As of the published date, no official fix or patch has been announced by IBM, and no known exploits are reported in the wild.

Successful exploitation of this SSRF vulnerability could allow an attacker to send unauthorized requests from the affected server, potentially bypassing security restrictions or gaining access to sensitive information not otherwise accessible. The impact includes confidentiality and integrity compromise but does not affect availability. The high CVSS score reflects the significant risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting the Ajax Proxy feature if feasible to reduce exposure. Monitor IBM's security advisories for updates on patches or recommended mitigations.