IBM WebSphere Application Server versions 9.0 and 8.5 are affected by a blind server-side request forgery (SSRF) vulnerability when processing SOAP requests. This vulnerability allows an attacker with low privileges to induce the server to make unauthorized requests to internal or external systems without user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.4.