What is the CVSS score of CVE-2026-10852?

CVE-2026-10852 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-10852?

Yes, a patch is available for CVE-2026-10852. Update the affected software to the latest version immediately.

WebSphere WebServer Plug-in CVE-2026-10852

EUVD-2026-38346 HIGH

NULL Pointer Dereference (CWE-476)

2026-06-22 ibm

GHSA-jfrh-xh86-v7pp

Denial Of Service Null Pointer Dereference IBM

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Network-reachable plug-in, no auth required, but AC:H reflects undisclosed triggering precondition; DoS-only impact means C:N/I:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jun 30, 2026 - 18:07 NVD

MEDIUM HIGH

CVSS changed

Jun 30, 2026 - 18:07 NVD

5.9 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Jun 22, 2026 - 20:17 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer Plug-in component when an attacker can pass crafted requests to the web server.

AnalysisAI

Denial of service in the IBM WebSphere WebServer Plug-in component affects IBM i 7.3 through 7.6, IBM WebSphere Application Server, and IBM WebSphere Application Server Liberty via a NULL pointer dereference (CWE-476) triggered by crafted HTTP requests. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms remote unauthenticated exploitation, though high attack complexity limits opportunistic mass exploitation. Impact is limited to availability - no confidentiality or integrity compromise - and no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The WebSphere WebServer Plug-in is an IBM-provided module that bridges front-end web servers (such as IBM HTTP Server, Apache HTTPD, or IIS) to back-end IBM WebSphere Application Server instances, handling request routing and load balancing via the IIS/WAS communication channel. CWE-476 (NULL Pointer Dereference) indicates the plug-in dereferences a pointer without validating it against null, typically occurring in request-parsing logic when unexpected or malformed input is processed. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* confirms IBM i (formerly OS/400) as the affected platform across all minor revisions. Because the plug-in operates at the web server layer, a crash in its processing pipeline terminates or disrupts the serving process rather than the application server itself, causing downstream unavailability to end users.

RemediationAI

A vendor-released patch is available per IBM's advisory at https://www.ibm.com/support/pages/node/7277344. Administrators should consult that page for the exact fix version applicable to their IBM i release and WebSphere Application Server edition, as no specific patched version number was available in the intelligence data at time of analysis. As a compensating control pending patch application, consider restricting network access to the web server's plug-in listener port at the firewall or network layer, particularly from untrusted external networks, to limit the population of hosts that can deliver crafted requests. Note that this mitigation may impact legitimate application routing if the plug-in serves both internal and external traffic - scope access restrictions carefully to avoid unintended availability impact to authorized clients. For Liberty-based deployments, review IBM's Fix Central for interim fixes applicable to the installed Liberty version.