IBM WebSphere Application Server versions 9.0 and 8.5 contain a remote code execution vulnerability in the SOAP/JMX connector. This vulnerability allows an attacker with low privileges to execute code remotely, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability is identified as CWE-502, related to deserialization issues. No specific affected sub-versions or patch information is provided.