CVE-2026-9336 describes a missing authentication vulnerability in IBM WebSphere Application Server 8.5 and 9.0. An unauthenticated remote attacker can send specially-crafted HTTP requests to an administrative endpoint, leading to denial of service by exhausting the server's filesystem space. This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and has a CVSS 3.1 base score of 6.5 with attack vector as adjacent network, low attack complexity, no privileges required, and no user interaction needed.

The vulnerability allows remote attackers to cause a denial of service condition by exhausting filesystem space on the affected server. There is no impact on confidentiality or integrity reported. The denial of service could disrupt availability of the WebSphere Application Server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor IBM advisories for updates. Until a fix is available, restricting access to administrative endpoints and applying network-level controls to limit exposure may help reduce risk.