Loading vulnerability…
Remote code execution in IBM WebSphere WebServer Plug-in with Intelligent Management
CVE-2026-9072 affects IBM WebSphere Application Server and WebSphere Application Server Liberty deployments using Intelligent Management with the WebSphere WebServer Plug-in component, including affected deployments on IBM i 7.3, 7.4, 7.5, and 7.6. An attacker who impersonates backend servers can send crafted responses to the plug-in, potentially causing remote code execution or denial of service. The underlying implementation defect and vulnerable function are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause remote code execution or denial of service in the affected WebSphere WebServer Plug-in deployment. The execution privilege level, extent of service disruption, and specific confidentiality or integrity consequences are not established.
If you can’t patch tonight, do this now.
Recommended interim measures include securely configuring Intelligent Management and the WebSphere WebServer Plug-in, implementing backend-server impersonation detection, and restricting plug-in network exposure through segmentation and trusted networks. These measures are not established as complete workarounds; applicable security fixes remain necessary.
Patch, then assume compromise.
Apply the applicable IBM WebSphere Application Server or Liberty security fixes for the installed version. For HCL VersionVault or DevOps Code ClearCase deployments, determine the WebSphere version used by the CCRC WAN server and apply the corresponding IBM fix directly to that host; no VersionVault-specific steps are necessary. Exact CVE-specific fixed versions are not established by the available information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.