PT-2026-43364 · Ibm · Web Server Plug-Ins For Ibm Websphere Application Server+1

Published 2026-05-26 · Updated 2026-06-14 · CVE-2026-8633

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty versions 8.5 through 9.0

Description Remote code execution is possible in the Web Server Plug-ins when processing a specially crafted request. This issue allows an unauthenticated network attacker to execute arbitrary code on the system.

Recommendations Apply APAR PH71342 to versions 8.5 through 9.0.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-8633

Affected Products

Web Server Plug-Ins For Ibm Websphere Application Server

Websphere Liberty

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-8633 · Security Note
• https://twitter.com/PurpleOps_io/status/2060635008155463714 · Twitter Post
• https://twitter.com/knaepp/status/2059297265701863578 · Twitter Post
• https://twitter.com/integ_sec/status/2066147403913118070 · Twitter Post
• https://ibm.com/support/pages/node/7274072 · Patch, Vendor Advisory
• https://twitter.com/securitydailyr/status/2061933242757115973 · Twitter Post
• https://twitter.com/dailytechonx/status/2061839261846900830 · Twitter Post
• https://t.me/CVEtracker/54999 · Telegram Post
• https://twitter.com/OrizonCyber/status/2059363985825083676 · Twitter Post
• https://twitter.com/knaepp/status/2059379056194228610 · Twitter Post