Critical RCE in IBM WebSphere Web Server Plug-ins Exposes Servers to Full Compromise
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen May 30, 2026
IBM disclosed a critical CVE-2026-8633 vulnerability in WebSphere Application Server and WebSphere Liberty deployments that use the optional Web Server Plug-ins component, warning that unauthenticated attackers can send specially crafted HTTP requests to execute arbitrary commands on the host. The flaw, classified as improper control of code generation (CWE-94) and rated CVSS 9.8, affects WebSphere Application Server traditional and Liberty versions 8.5 and 9.0, with successful exploitation potentially leading to full system compromise.
IBM also patched CVE-2026-8620, an HTTP request smuggling issue that could let attackers bypass security controls and manipulate backend communications in affected environments. The company said both issues are addressed through APAR PH71342 and related fix packs, and advised administrators to apply the fixes, validate updates in non-production environments, monitor HTTP traffic, restrict exposure of plug-in endpoints, use WAF protections, and perform threat hunting for signs of exploitation.
