CVE-2026-9322 is a vulnerability in IBM WebSphere Application Server (versions 9.0 and 8.5) and Liberty (versions 17.0.0.3 through 26.0.0.7) that allows an unauthenticated attacker to cause a denial of service via a specially crafted HTTP request. The issue is classified as CWE-400, indicating uncontrolled resource consumption. The vulnerability impacts availability but does not affect confidentiality or integrity. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation results in denial of service by exhausting resources, causing the affected WebSphere Application Server instances to become unavailable. There is no impact on data confidentiality or integrity. The high CVSS score reflects the ease of remote exploitation without authentication and the significant impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing network-level protections such as rate limiting or filtering suspicious HTTP requests to mitigate potential exploitation. Monitor IBM's security advisories for updates.