What is the CVSS score of CVE-2026-8835?

CVE-2026-8835 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of IBM HTTP Server are affected by CVE-2026-8835?

IBM HTTP Server 8.5 and 9.0 contain a pointer dereference flaw allowing authenticated administrators to expose sensitive data or trigger service disruptions.. A patch is available.

How to fix or mitigate CVE-2026-8835?

Within 24 hours: Identify all IBM HTTP Server 8.5 and 9.0 deployments and restrict administrative access to trusted networks only; document current patch status. Within 7 days: Deploy the available vendor patch to all affected IBM HTTP Server 8.5 and 9.0 instances and validate critical application functionality post-deployment. Within 30 days: Achieve 100% patch coverage across all IBM HTTP Server systems, review administrative access controls, and confirm remediation in configuration management.

IBM HTTP Server CVE-2026-8835

EUVD-2026-31918 HIGH

Untrusted Pointer Dereference (CWE-822)

2026-05-26 ibm

GHSA-2c97-gp89-gf5p

Denial Of Service IBM Http Server

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:10 vuln.today

DescriptionCVE.org

IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.

AnalysisAI

Invalid pointer dereference in IBM HTTP Server 8.5 and 9.0 allows an authenticated privileged user on the Administration Server to expose sensitive information or trigger a denial-of-service condition. The flaw requires adjacent network access and existing low-level privileges, and no public exploit identified at time of analysis. EPSS exploitation probability is negligible (0.01%) and CISA SSVC indicates no observed exploitation.

Technical ContextAI

IBM HTTP Server is IBM's commercially supported HTTP server distribution based on the Apache HTTP Server codebase, frequently bundled with WebSphere Application Server for hosting web content and proxying requests to backend J2EE applications. The Administration Server is a separate management daemon used to remotely administer the HTTP Server instance. The root cause is classified as CWE-822 (Untrusted Pointer Dereference), where the program dereferences a pointer whose value is influenced by untrusted input, leading to memory access at an invalid or attacker-influenced address - typically resulting in a process crash (DoS) or, in the disclosure case here, reading memory contents that the process should not return to the caller. The affected CPE is cpe:2.3:a:ibm:http_server, covering both the 8.5 and 9.0 product lines.

RemediationAI

Patch available per vendor advisory - apply the fix described in IBM Support note https://www.ibm.com/support/pages/node/7274065, which provides the corrective interim fix for 8.5 and the patched 9.0 build (consult the advisory for the exact iFix identifier applicable to your release). As compensating controls until the fix is deployed, restrict network reachability of the IBM HTTP Server Administration Server to a dedicated management VLAN or jump host (the AV:A vector means non-adjacent attackers cannot reach it), enforce strong authentication and rotate Administration Server credentials to reduce the chance that the required PR:L privilege is held by a compromised account, and audit who currently holds Administration Server access - the trade-off of tightening admin network exposure is reduced operational convenience for remote administrators, which is acceptable for a management plane.