IBM HTTP Server CVE-2026-8834

Attacker must (1) have network reachability to the IBM HTTP Server Administration Server on an adjacent network segment (CVSS AV:A - not routable from the open internet by design), (2) hold valid low-privilege credentials authenticated to the Administration Server (CVSS PR:L - the description explicitly states 'A privileged user, authenticated to the Administration Server'), and (3) target an unpatched IHS 8.5.0 at or below Interim Fix 002, or any 9.0 release prior to the fix in IBM advisory 7274065. No user interaction is required (UI:N), and attack complexity is low once the prerequisites are met (AC:L). The adjacent-only attack vector and required admin-tier authentication are the dominant limiting factors that keep real-world exposure narrow despite the High CVSS score.

Signals diverge sharply: CVSS rates the issue High (8.0) on the strength of HIGH impact across confidentiality, integrity, and availability, but the vector AV:A/AC:L/PR:L meaningfully constrains real-world reach - the attacker must be on an adjacent network segment and must already hold credentials on the Administration Server, which is typically firewalled to admin VLANs. EPSS at 0.01% (0th percentile), absent CISA KEV listing, SSVC 'Exploitation: none,' and no public POC all indicate exploitation is not occurring and is not trivially weaponizable. SSVC 'Automatable: no' further suggests this is not a worm-class issue. The realistic priority is moderate: patch on a normal cycle, prioritized higher only in environments where the Administration Server is exposed beyond a tightly controlled admin network or where many low-trust operators have admin credentials.

An insider or a foothold-holder who has compromised a low-privilege Administration Server account on the management network sends a crafted administrative request whose oversized field overflows a heap buffer in the IHS admin handler, corrupting adjacent heap metadata to either crash the process (DoS of the managed web tier) or hijack execution and run code with the privileges of the IHS administrative process. No public POC has been published, so a working exploit would currently need to be developed from the patch diff.