IBM WebSphere AppServer 8.5/9.0 ORB flaw permits arbitrary class loading via IIOP
CVE-2026-8400 Published on August 5, 2026
Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.
Vulnerability Analysis
CVE-2026-8400 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Reflection Injection Vulnerability?
The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. If the application uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the application to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the application's classpath (CWE-427) or add new entries to the application's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the application.
CVE-2026-8400 has been classified to as a Reflection Injection vulnerability or weakness.
Products Associated with CVE-2026-8400
stack.watch emails you whenever new vulnerabilities are published in IBM WebSphere Application Server or IBM Websphere Application Server Liberty. Just hit a watch button to start following.
Affected Versions
IBM WebSphere Application Server:- Version 8.5 is affected.
- Version 9.0 is affected.
- Version Continuous delivery is affected.