IBM WebSphere Plug-ins Flaws Expose Servers to Request Smuggling and RCE
Patch & Detection Intelligence · 7 sources · Updated 4mo ago · First seen Jul 10, 2026
IBM disclosed multiple vulnerabilities in the optional Web Server Plug-ins used with WebSphere Application Server and WebSphere Liberty, including CVE-2026-8633, a critical unauthenticated code injection flaw rated CVSS 9.8, and CVE-2026-8620, an HTTP request smuggling issue rated CVSS 7.5. The bugs affect supported 8.5 and 9.0 plug-in branches that sit in front of back-end WebSphere servers on platforms including Apache HTTP Server, Microsoft IIS, and IBM HTTP Server, allowing specially crafted HTTP requests to bypass trust boundaries, reach internal application servers, and potentially achieve arbitrary code execution and full system compromise.
IBM said no workarounds or mitigations are available and directed customers to apply interim fixes or upgrade to fixed plug-in versions tied to APAR PH71342, later updated under PH71376. IBM support notices said fixes were released through Fix Central for affected 9.0.5.24-9.0.5.27 and 8.5.5.25-8.5.5.29 ranges, with permanent remediation targeted for inclusion in WebSphere Application Server 9.0.5.28 and 8.5.5.30. The combined disclosure raised concern that request smuggling could help attackers bypass perimeter controls before exploiting the RCE flaw in exposed enterprise deployments.
