IBM WebSphere Web Server Plug-ins RCE & HTTP Request Smuggling Vulnerabilities (CVE-2026-8633/CVE-2026-8620) Security Bulletin

Vulnerability Overview IBM WebSphere Application Server and WebSphere Application Server Liberty contain multiple vulnerabilities when using Web Server Plug-ins, including remote code execution and HTTP request smuggling. Impact Scope CVE-2026-8633 - Description: IBM WebSphere Application Server and WebSphere Application Server Liberty, when using Web Server Plug-ins, may be vulnerable to remote code execution via a specially crafted request. - CWE: CWE-94: Improper Control of Generation of Code (Code Injection) - CVSS Base Score: 9.8 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVE-2026-8620 - Description: IBM WebSphere Application Server and WebSphere Application Server Liberty, when using Web Server Plug-ins, may be vulnerable to HTTP request smuggling via a specially crafted request. - CWE: CWE-444: Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) - CVSS Base Score: 7.5 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Remediation IBM strongly recommends addressing the vulnerabilities by applying the currently available interim fixes for Web Server Plug-ins or fix packs that contain the fixes. Web Server Plug-ins for IBM WebSphere Application Server (for IBM WebSphere Application Server traditional or Liberty): - For V9.0.0.0 through 9.0.5.27: - Upgrade to the required interim fix level, then apply the Web Server Plug-ins interim fix that resolves PH71342. - Alternatively, apply Web Server Plug-ins Fix Pack 9.0.5.28 or later (target availability 2Q2026). - For V8.5.0.0 through 8.5.5.29: - Upgrade to the required interim fix level, then apply the Web Server Plug-ins interim fix that resolves PH71342. - Alternatively, apply Web Server Plug-ins Fix Pack 8.5.5.30 or later (target availability 3Q2026). Affected Products and Versions Additional Information Document ID: 7274072 Last Updated: 26 May 2026 Initial Release Date: 26 May 2026 Reference Links Complete CVSS v3 Guide On-line Calculator v3 Related Resources IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard" designed to convey vulnerability severity and help determine the urgency and priority of response. IBM provides the CVSS score "as is" without warranty of any kind, express or implied. Customers are responsible for assessing the impact of any actual or potential security vulnerabilities. IBM regularly updates the records of components included in its product portfolio. As part of that effort, if IBM identifies a previously unidentified package in a product/service, we will address the relevant vulnerability regardless of its CVE date. The inclusion of an older CVEID does not indicate that the referenced product has been used by IBM since that date or that IBM was aware of the vulnerability at that time. We strive to inform customers of relevant vulnerabilities as we become aware of them. The IBM Security Bulletin referenced as "affected products and versions" is intended to support only IBM and supported products and versions and has not passed their end of support or warranty date. Therefore, this security bulletin not referencing unsupported or extended support products and versions does not constitute a determination by IBM that they are not affected by the vulnerability. Referencing this security bulletin with one or more unsupported versions should not create an obligation for IBM to provide fixes for any unsupported or extended support product or version.

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere Web Server Plug-ins RCE & HTTP Request Smuggling Vulnerabilities (CVE-2026-8633/CVE-2026-8620) Security Bulletin