SecuriTricks - CVE-2026-8858

Description

IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

Product(s) Impacted

Vendor	Product	Versions
Ibm	Ibm I Websphere Application Server Websphere Application Server Liberty	7.3, 7.4, 7.5, 7.6 * *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
o	ibm	ibm_i	7.3	/	/	/	/	/	/	/
o	ibm	ibm_i	7.4	/	/	/	/	/	/	/
o	ibm	ibm_i	7.5	/	/	/	/	/	/	/
o	ibm	ibm_i	7.6	/	/	/	/	/	/	/
a	ibm	websphere_application_server	/	/	/	/	/	/	/	/
a	ibm	websphere_application_server_liberty	/	/	/	/	/	/	/	/

References

https://www.ibm.com/support/pages/node/7277344

CVSS Score

7.5 / 10

CVSS Data - 3.1

Attack Vector: ADJACENT_NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

View Vector String

Timeline

Published: June 22, 2026, 4:16 p.m.
Last Modified: June 22, 2026, 5:09 p.m.

Status : Undergoing Analysis

CVE is currently being analyzed by NVD staff, this process results in association of reference link tags, CVSS scores, CWE association, and CPE applicability statements.

More info

Source

[email protected]

CVE-2026-8858