Skip to main content
protocols.pageprotocols.page
9043

Port 9043 – WebSphere Admin HTTPS

TCP

Port 9043 is the IBM WebSphere Application Server admin console HTTPS port. The admin console on port 9043 provides full server control – deploying applications, configuring resources, managing security. Restrict to management networks. WebSphere deserialization vulnerabilities enable remote code execution if exposed.

Port Number

9043

Protocol

TCP

Service

IBM WebSphere Admin Console (SSL)

Range

IANA Registered (1024–49151)

Description

IBM WebSphere Application Server serves its administrative console over HTTPS on port 9043 (HTTP on 9060). The console provides deployment, configuration, clustering, and security management for Java EE applications running on WebSphere. WebSphere has a history of critical deserialization vulnerabilities (CVE-2020-4450, CVE-2015-7450) that enable unauthenticated remote code execution via the admin port. The SOAP connector (port 8880) and admin console (9043) are both attack vectors. Never expose these ports to untrusted networks. Apply IBM security patches promptly, restrict admin access to jump boxes, and consider disabling the admin console entirely in production (manage via wsadmin scripting).

Security risks

  • 1CVE-2020-4450 (CVSS 9.8): WebSphere IIOP deserialization RCE – unauthenticated attacker sends crafted IIOP request to the admin port, achieving remote code execution as the WebSphere service account. No interaction required. Patch: PH25074.
  • 2CVE-2015-7450: Apache Commons Collections deserialization in WebSphere admin console – attacker sends serialized Java object via SOAP connector, gaining code execution. Exploited in the wild for years before patches were widely applied.
  • 3Admin console exposes full server lifecycle: deploy/undeploy applications, modify JVM settings, change security domains, add users, and execute MBeans. A single compromised admin session = complete application server takeover.
  • 4WebSphere SOAP connector (port 8880) and admin console (9043) share the same credential store – compromising either grants access to both management interfaces.
  • 5Self-signed certificates on port 9043 train administrators to bypass TLS warnings, making them vulnerable to MITM attacks on the admin console where they enter credentials.

Firewall guidance

Restrict port 9043 to dedicated management workstations on an isolated admin VLAN. Never expose to the internet or general application traffic. Use jump boxes with MFA for remote admin access. Consider disabling the admin console entirely in production and managing via wsadmin scripting over localhost. If the console must remain active, configure IP allowlists in WebSphere's admin console access settings.

Diagnosis commands

Check if WebSphere admin console is responding on HTTPS

shell
curl -kI https://washost:9043/ibm/console/ 2>&1 | head -5

Inspect admin console TLS certificate validity and subject

shell
openssl s_client -connect washost:9043 </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

Audit TLS cipher suites on admin console (check for weak ciphers)

shell
nmap -sV -p 9043 --script ssl-enum-ciphers target

Verify which process owns port 9043 and its bind address

shell
ss -tnlp sport = :9043

Usage examples

Port 9043 – WebSphere Admin HTTPS
shell
https://washost:9043/ibm/console/
wsadmin.sh -conntype SOAP -host localhost -port 8880
iptables -A INPUT -p tcp --dport 9043 -s ADMIN_SUBNET -j ACCEPT

Common services on this port

IBM WebSphere Application Server (Traditional)IBM WebSphere Application Server NDIBM WebSphere Liberty (optional)

Related ports

9060

WebSphere Admin HTTP (unencrypted – disable)

9080

WebSphere Application HTTP

9443

WebSphere Application HTTPS

8880

WebSphere SOAP Connector

History

IBM WebSphere Application Server was first released in 1998 for Java servlet hosting. Port 9043 became the admin console HTTPS default in WebSphere 5.x (2003). The admin console was built on the Integrated Solutions Console (ISC) framework. WebSphere's deserialization vulnerabilities (2015-2020) made ports 9043 and 8880 high-value targets for attackers. IBM Liberty (lightweight runtime, 2012) uses a different admin model but can still expose port 9043 for backward compatibility.

FAQ

Should I disable the WebSphere admin console in production?

Yes, if possible. Use wsadmin (Jython scripting via SOAP connector on localhost) or Ansible/Chef for configuration management. The admin console is a web application that increases attack surface. If you must keep it, restrict to localhost + SSH tunnel or a single jump box IP. Set adminConsoleEnabled=false in deployment manager configuration for managed nodes.

How do I check if my WebSphere is vulnerable to CVE-2020-4450?

Check WebSphere version: /opt/IBM/WebSphere/AppServer/bin/versionInfo.sh. Vulnerable: all versions before 8.5.5.18, 9.0.5.5. The exploit requires IIOP access (usually port 2809 or 9100 for bootstrap). Patch: apply PH25074 or upgrade. Temporary mitigation: disable IIOP endpoint if not required (admin console uses HTTP/SOAP, not IIOP for most operations).