PT-2026-43370 · Ibm · Ibm Websphere Application Server+2

Published 2026-05-26 · Updated 2026-05-28 · CVE-2026-9170

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM HTTP Server versions 8.5 and 9.0 IBM WebSphere Application Server versions 8.5 and 9.0 IBM WebSphere Application Server Liberty versions 8.5 and 9.0

Description IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty are affected by improper input validation and incorrect code generation management. This issue can lead to HTTP Request Smuggling, a technique where the frontend and backend servers interpret the boundaries of an HTTP request differently. Exploitation of this flaw may allow a remote attacker to execute arbitrary code or cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

DoS

HTTP Request/Response Smuggling

Code Injection

Weakness Enumeration

CWE-444

CWE-94

Related Identifiers

BDU:2026-07486

CVE-2026-9170

Affected Products

Ibm Http Server

Ibm Websphere Application Server

Websphere Liberty

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-9170 · Security Note
• https://bdu.fstec.ru/vul/2026-07486 · Security Note
• https://ibm.com/support/pages/node/7274065 · Patch, Vendor Advisory
• https://t.me/CVEtracker/55005 · Telegram Post
• https://t.me/cveNotify/164880 · Telegram Post
• https://twitter.com/DFIR_Lab/status/2059811197428383897 · Twitter Post
• https://ibm.com/support/pages/node/7274072 · Patch, Vendor Advisory