CVE-2026-9319 is a critical vulnerability in IBM WebSphere Application Server 8.5 and 9.0 caused by unsafe deserialization of untrusted data through JAX-WS endpoints that use WS-Security. This weakness (CWE-502) can lead to remote code execution by an unauthenticated attacker over the network. The vulnerability affects core application server components and has a CVSS score of 9.0, reflecting its severity. As of the published date, no official remediation or patch has been documented.

Successful exploitation of this vulnerability could result in complete compromise of the affected WebSphere Application Server, including unauthorized remote code execution, full system control, and potential disruption of services. The CVSS vector indicates the attack requires network access but no privileges or user interaction, making it highly severe. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting network access to JAX-WS endpoints with WS-Security and monitor for suspicious activity related to deserialization attempts. Avoid exposing vulnerable services to untrusted networks where possible.