Remote code execution and denial of service in IBM HTTP Server (CVE-2026-8855)

IBM HTTP Server 8.5 and 9.0 is vulnerable to remote code execution and denial of service when configured with TLS mutual authentication (client authentication). The vulnerability is classified as improper control of code generation (CWE-94) and carries a CVSS base score of 8.1, indicating high impact to confidentiality, integrity, and availability. No authentication is required to exploit this vulnerability over the network, though attack complexity is rated high. Affected versions: - IBM HTTP Server 8.5 - IBM HTTP Server 9.0 We recommend updating to: Fix Pack 9.0.5.29, Fix Pack 8.5.5.30. CVSS 9.8 · our assessment: act_now Reference: https://www.ibm.com/support/pages/node/7274065 Details: https://vuln.today/cve/CVE-2026-8855