CVE-2025-36038: Critical Deserialization Flaw in IBM WebSphere

CVE-2025-36038 is a critical (CVSS 9.0) deserialization flaw in IBM WebSphere Application Server 8.5 and 9.0. A remote attacker could run code with a crafted sequence of serialized objects. IBM's fix is the interim fix for APAR PH66674, or Fix Pack 9.0.5.25 or 8.5.5.28 and later.

What's affected

IBM's bulletin lists WebSphere Application Server traditional in these ranges:

• Version 9.0.0.0 through 9.0.5.24
• Version 8.5.0.0 through 8.5.5.27

The record lists many host platforms, since the product runs on Windows, Linux, AIX, IBM i, z/OS, Solaris and HP-UX. IBM gives the CVSS vector as network reachable, high attack complexity, no privileges and no user interaction, with scope changed. The record does not mark the flaw as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.

How to check if you're exposed

1. On each server, run the versionInfo script found in the bin folder of the installation. It prints the product version and installed fixes.
2. Compare the version with the ranges above. Anything up to 9.0.5.24 or 8.5.5.27 is affected.
3. Look in the versionInfo output for the interim fix that resolves PH66674, or a fix pack at or above 9.0.5.25 or 8.5.5.28.
4. List which servers expose remote administration or invocation ports to wider networks. Fewer reachable ports lowers risk.
5. Look up the CVE in the Gold directory, and run the free in-browser dependency scan at gold.safeguard.sh/scan on the applications you deploy on top.

What to do now

1. Follow IBM's bulletin. For 9.0, upgrade to the minimum fix pack level the interim fix requires and apply the interim fix for PH66674, or apply Fix Pack 9.0.5.25 or later.
2. For 8.5, do the same with the PH66674 interim fix, or apply Fix Pack 8.5.5.28 or later.
3. Treat internet-facing and management network servers first.
4. Restrict network access to administrative and remote invocation ports.
5. Record the change in your asset list and recheck with versionInfo afterwards.

IBM lists no workarounds or mitigations, so patching is the only complete answer.

Why it matters

The class is CWE-502, deserialization of untrusted data. Serialization turns objects into bytes. If a server rebuilds objects from bytes it did not create, the data can drive code paths that the developer never meant to expose.

Java application servers have faced this class repeatedly, because remote protocols often pass serialized objects. The attack complexity here is rated high, which keeps the score at 9.0 rather than higher, but the impact is a full compromise of confidentiality, integrity and availability.

Knowing whether a vulnerable call path is reachable in your own deployment helps rank work. That is the idea behind reachability analysis.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• IBM security bulletin
• Gold vulnerability page

Last reviewed: 18 October 2026.