CVE-2026-9330 is a deserialization vulnerability (CWE-502) affecting IBM WebSphere Application Server versions 8.5 and 9.0. The flaw arises from improper validation of untrusted user input during deserialization in the SAML Web Single Sign-On component. Exploitation requires sending a crafted HTTP request that leverages a suitable gadget chain to achieve remote code execution. The CVSS v3.1 base score is 8.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on affected IBM WebSphere Application Server instances. This could lead to full compromise of the server, including unauthorized access, data disclosure, and disruption of service. The vulnerability affects critical components related to authentication (SAML Web SSO), increasing the risk of severe impact.

As of the current information, no official patch or remediation has been announced by IBM. Users should monitor IBM's security advisories for updates and apply patches promptly once available. Until a fix is released, consider restricting access to the SAML Web Single Sign-On component to trusted networks and implement compensating controls such as web application firewalls to detect and block suspicious deserialization payloads. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.