Port 9060 – WebSphere Admin HTTP

TCP

Port 9060 is the IBM WebSphere Application Server admin console HTTP (unencrypted) port. Always use port 9043 (HTTPS) instead. Port 9060 transmits admin credentials in cleartext. In production, disable HTTP admin access entirely and enforce HTTPS-only console access.

Port Number

9060

Protocol

TCP

Service

IBM WebSphere Admin Console (HTTP)

Range

IANA Registered (1024–49151)

Description

WebSphere admin console on port 9060 serves the same management interface as port 9043 but without TLS encryption. Admin credentials, session tokens, and configuration data travel in cleartext. Any network observer between the administrator and the server can capture full admin access. Port 9060 should be disabled in production environments. Configure WebSphere to redirect 9060 to 9043 or disable the HTTP transport entirely. The admin console should only be accessible from dedicated management workstations on an isolated network segment.

Security risks

1Credentials in cleartext: admin username and password transmitted as plaintext HTTP Basic/Form auth over port 9060. Any network observer (ARP spoof, WiFi sniff, span port) captures full WebSphere admin credentials.
2Session hijacking: JSESSIONID cookie for the admin console sent without Secure flag over HTTP – trivially intercepted and replayed for full admin access without knowing the password.
3All CVEs affecting port 9043 apply equally to port 9060: CVE-2020-4450 (IIOP deserialization RCE), CVE-2015-7450 (Commons Collections deserialization) – HTTP vs HTTPS does not affect exploit viability.
4Man-in-the-middle modification: an attacker on the network path can inject JavaScript into admin console responses, capturing additional credentials or modifying configurations silently.

Firewall guidance

Disable port 9060 entirely. Configure WebSphere to serve admin console on HTTPS port 9043 only. In Administrative Console > Security > Global Security, enforce HTTPS-only admin access. If migration takes time, firewall port 9060 at the host level: iptables -A INPUT -p tcp --dport 9060 -j DROP. Never route port 9060 traffic across network segments.

Diagnosis commands

Check if unencrypted admin console is accessible (should be refused/redirected)

shell

curl -I http://washost:9060/ibm/console/ 2>&1 | head -3

Verify if anything is still listening on the insecure port

shell

ss -tnlp sport = :9060

Detect WebSphere HTTP admin remotely (should show closed if properly disabled)

shell

nmap -sV -p 9060 target

Usage examples

Port 9060 – WebSphere Admin HTTP

shell

http://washost:9060/ibm/console/ (INSECURE – use 9043)
AdminConfig: modify transport chain to disable HTTP
Redirect: iptables PREROUTING --dport 9060 -j REDIRECT --to-port 9043

Common services on this port

IBM WebSphere Application Server (Traditional)IBM WebSphere Application Server ND

Related ports

9043

WebSphere Admin HTTPS (use this instead)

9080

WebSphere Application HTTP

8880

WebSphere SOAP Connector

History

Port 9060 was the original WebSphere admin console HTTP port, predating widespread TLS adoption in enterprise middleware. IBM maintained it for backward compatibility with older admin scripts and browsers that struggled with self-signed certificates. Modern IBM documentation recommends HTTPS-only administration. WebSphere Liberty profiles do not enable a separate HTTP admin port by default.

FAQ

How do I disable port 9060 in WebSphere?

In the admin console (via 9043): Servers > Server Types > WebSphere application servers > server1 > Web Container > Web container transport chains. Delete or disable the WCInboundAdmin chain for port 9060. Alternatively, in server.xml: remove the transportChannel for port 9060. Restart the server. Verify with: ss -tnlp sport = :9060 returns nothing.