CVE-2026-9322 affects IBM WebSphere Application Server 9.0, 8.5, and Liberty editions from 17.0.0.3 up to 26.0.0.7. The vulnerability is a denial of service caused by processing a specially crafted HTTP request, classified under CWE-400 (Uncontrolled Resource Consumption). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (no confidentiality or integrity impact). No known exploits are reported in the wild. No patch or remediation information is provided in the available data.

Successful exploitation results in denial of service, causing the affected IBM WebSphere Application Server instances to become unavailable or unresponsive. There is no impact on data confidentiality or integrity. This can disrupt business operations relying on the affected server versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as filtering or rate-limiting suspicious HTTP requests to mitigate potential denial of service attempts. Monitor vendor communications for updates on patches or official mitigations.