CVE-2019-4279: IBM WebSphere Application Server deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction and a very high EPSS probability make this a top-priority remote code execution flaw despite no KEV listing.

What it is

IBM WebSphere Application Server 8.5 and 9.0 deserialize untrusted serialized object streams, allowing a remote attacker to execute arbitrary code. The flaw is a classic CWE-502 deserialization issue with a critical CVSS score of 9.8, so any reachable endpoint that accepts serialized data is a serious exposure.

Impact

An unauthenticated remote attacker can run arbitrary code with the privileges of the WebSphere process, leading to full host compromise and potential lateral movement.

Attack surface

Reached over the network via a crafted sequence of serialized objects sent to a WebSphere endpoint that deserializes untrusted data. The CVSS vector shows no privileges and no user interaction required, so it is remotely exploitable without authentication.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high at 0.799 (99.6th percentile), indicating strong likelihood of exploitation activity. References are vendor and third-party advisories only, with no public exploit tag supplied.

What to do

• Apply the IBM fix for WebSphere Application Server 8.5 and 9.0 per IBM support document uid=ibm10883628.
• If patching is delayed, restrict network access to WebSphere administrative and application endpoints to trusted sources only.
• Disable or block deserialization of untrusted object streams where the application allows it, and review custom code for unsafe readObject usage.
• Run the WebSphere service with least privilege and segment it from sensitive internal networks.
• Monitor IBM advisories for updated fixes or interim mitigations for this X-Force ID 160445 issue.

Detection

• Inspect WebSphere and application logs for deserialization errors, class-loading anomalies, or unexpected object stream processing.
• Monitor for outbound connections or child processes spawned by the WebSphere JVM that are not part of normal operation.
• Alert on network traffic to WebSphere endpoints containing Java serialization magic bytes (0xACED) from untrusted sources.
• Baseline normal WebSphere process behavior and alert on new command execution, file writes, or unusual JVM child processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.