IBM WebSphere WebSphere Web Server Plug-in RCE and DoS Vulnerabilities Advisory

Vulnerability Overview Multiple vulnerabilities exist in IBM WebSphere Application Server and WebSphere Application Server Liberty when using Web Server Plug-ins, which may lead to remote code execution and service denial. Affected Versions CVE-2026-10852 - Description: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty may experience a service denial if an attacker sends a crafted request while using the WebSphere WebServer Plug-in component. - CWE: CWE-476: NULL Pointer Dereference - CVSS Base Score: 5.9 - CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-8858 - Description: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty may experience remote code execution and service denial if an attacker simulates the application server and sends a crafted response while using the WebSphere WebServer Plug-in component. - CWE: CWE-94: Improper Control of Generation of Code (Code Injection) - CVSS Base Score: 7.5 - CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2026-9072 - Description: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty may experience remote code execution and service denial if an attacker simulates the backend server and sends a crafted response while using the WebSphere WebServer Plug-in component. - CWE: CWE-94: Improper Control of Generation of Code (Code Injection) - CVSS Base Score: 8.1 - CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Remediation IBM strongly recommends applying the currently available interim fix or fix pack for Web Server Plug-ins, which contains the fix for APAR PH71376, immediately. Web Server Plug-ins for IBM WebSphere Application Server (for traditional WebSphere Application Server or Liberty) - V9.0.0.0 to 9.0.5.27 - Upgrade to the required interim fix level, then apply the Web Server Plug-ins interim fix to address PH71376. - Alternatively, apply Fix Pack 9.0.5.28 or later (target availability: 2Q2026). - V8.5.0.0 to 8.5.5.29 - Upgrade to the required interim fix level, then apply the Web Server Plug-ins interim fix to address PH71376. - Alternatively, apply Fix Pack 8.5.5.30 or later (target availability: 3Q2026). Additional Information Affected Products and Versions - IBM Web Server Plug-ins for IBM WebSphere Application Server and WebSphere Application Server Liberty: 8.5, 9.0 - IBM HTTP Server: 9.0 Workarounds and Mitigations - None References - Complete CVSS v3 Guide - Online Calculator v3 Related Resources - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer - The Common Vulnerability Scoring System (CVSS) is an industry standard, as defined by the Forum of Incident Response and Security Teams (FIRST), used to convey vulnerability severity and determine the urgency and priority of response. IBM provides CVSS scores "as is" and makes no express or implied warranties. Customers should assess the impact of the vulnerability on their environment. IBM regularly updates product component records and discloses relevant vulnerabilities when identified.

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere WebSphere Web Server Plug-in RCE and DoS Vulnerabilities Advisory

More from this source