Loading vulnerability…
Remote Code Execution in IBM Web Server Plug-ins for WebSphere
CVE-2026-8633 is a CWE-94 code-injection vulnerability in IBM Web Server Plug-ins used with WebSphere Application Server and WebSphere Liberty. A remote attacker can send a specially crafted HTTP request to the plug-in and trigger remote code execution. The affected component operates at the front-end web-server tier, routing inbound traffic to back-end WebSphere instances. Affected deployments use vulnerable 8.5 or 9.0 Web Server Plug-ins versions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code in the affected host environment, potentially resulting in full compromise of the system. The CVSS v3.1 score is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impact.
If you can’t patch tonight, do this now.
IBM states that no vendor-provided workaround or mitigation is available; patching is the required remediation. Pending patch deployment, reduce exposure by restricting external access to plug-in endpoints, placing them behind controlled reverse-proxy or WAF layers, segmenting front-end web servers from back-end application servers, and monitoring for anomalous or malformed HTTP requests. These measures are compensating controls and do not eliminate the vulnerability.
Patch, then assume compromise.
Apply the IBM fix for APAR PH71342. Upgrade Web Server Plug-ins 9.0 to Fix Pack 9.0.5.28 or later, or apply the applicable interim fix after meeting its required prerequisite fix-pack level. Upgrade Web Server Plug-ins 8.5 to Fix Pack 8.5.5.30 or later, or apply the applicable interim fix after meeting its prerequisite level. Validate updates in a non-production environment and verify package integrity before deployment.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.