CVE-2026-8400 Deserialization in WebSphere Application Server
A flaw in the IBM Java SDK ORB component allows a malicious IIOP server to trigger arbitrary class instantiation, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8400?
CVE-2026-8400 is a high-severity unsafe deserialization vulnerability in Ibm Websphere Application Server, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.
Weakness: CWE-470
Which versions are affected by CVE-2026-8400?
It affects 1 product.
Products include Ibm Websphere Application Server.
How do I fix CVE-2026-8400?
Apply the vendor's patch.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-8400 being exploited?
There is no known exploitation of CVE-2026-8400 in the wild and no public exploit code.
Other vulnerabilities in Ibm Websphere Application Server
Sources
Also known as GHSA-m4rx-9mrh-59g9.