IBM HTTP Server CVE-2026-8835

The attacker must (1) have valid authenticated credentials to the IBM HTTP Server Administration Server (CVSS PR:L), (2) reach the Administration Server over an adjacent network - same broadcast/management segment or VPN - rather than the open internet (CVSS AV:A), and (3) target an IBM HTTP Server 8.5 instance at or below Interim Fix 002, or a vulnerable 9.0 build. No user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited by the fact that the Administration Server is a management interface that, in hardened deployments, is not exposed to general user networks, and by the requirement for pre-existing privileged credentials.

Signals are consistent and converge on a moderate-to-low real-world priority. CVSS 7.3 (High) is driven by High confidentiality and availability impact, but the vector AV:A/AC:L/PR:L/UI:N tempers this: exploitation requires adjacent network access and an already-authenticated privileged Administration Server account, which is a substantial precondition since the Administration Server should not be exposed beyond a management network. EPSS (0.01%, 0th percentile) and the CISA SSVC framework (Exploitation: none, Automatable: no, Technical Impact: partial) reinforce that this is not an opportunistic mass-exploitation candidate. Note that CVSS shows I:N (no integrity impact) yet C:H and A:H, matching the description of information disclosure or DoS but not code execution. There is no KEV listing and no public exploit identified at time of analysis, so this is best treated as a routine patching priority rather than an emergency, with elevated urgency only where the Administration Server is accessible from broader networks.

An attacker who has obtained credentials for a low-privileged Administration Server account (for example, via phishing of an IBM HTTP Server administrator or reuse of leaked credentials) and who sits on the same management network segment as the server sends crafted administrative input that causes the server to dereference an invalid pointer. The result is either a crash of the Administration Server process (denial of service for management operations) or the leakage of adjacent process memory containing configuration secrets. No public proof-of-concept is currently available.