What is the CVSS score of CVE-2026-8850?

CVE-2026-8850 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of IBM HTTP Server are affected by CVE-2026-8850?

IBM HTTP Server versions 8.5 and 9.0 contain a remote denial-of-service vulnerability that can crash the web server when the optional mod_ibm_upload module is enabled, disrupting web services.. A patch is available.

How to fix or mitigate CVE-2026-8850?

Within 24 hours: Inventory all IBM HTTP Server 8.5 (up to Interim Fix 002) and 9.0 deployments to identify instances with mod_ibm_upload module enabled. Within 7 days: Apply vendor patch via IBM support note 7274065 or disable the mod_ibm_upload module as interim mitigation. Within 30 days: Complete patch deployment across all affected systems and verify patch application through vulnerability scanning.

IBM HTTP Server CVE-2026-8850

EUVD-2026-31894 HIGH

NULL Pointer Dereference (CWE-476)

2026-05-26 ibm

GHSA-f24c-2c3h-f7jx

Denial Of Service Null Pointer Dereference IBM Http Server

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:55 vuln.today

DescriptionCVE.org

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.

AnalysisAI

Denial of service in IBM HTTP Server 8.5 and 9.0 allows remote unauthenticated attackers to crash the web server when the optional mod_ibm_upload module is loaded, triggering a null pointer dereference (CWE-476). No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02% (4th percentile), though SSVC flags the issue as automatable with partial technical impact. Affected deployments include HTTP Server 8.5 up to Interim Fix 002 and HTTP Server 9.0, with a vendor patch available via IBM support note 7274065.

Technical ContextAI

IBM HTTP Server is IBM's distribution of the Apache HTTP Server, bundled with WebSphere Application Server and used as a front-end web tier for J2EE applications. The vulnerable component is mod_ibm_upload, an optional IBM-specific Apache module that handles file upload processing - it is not loaded by default in stock Apache installs. The root cause is a CWE-476 null pointer dereference: a code path in the module dereferences a pointer that can be NULL when handling certain request inputs, causing the worker process to crash. Affected CPE is cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*, covering the 8.5.x line through Interim Fix 002 and the 9.0 branch.

RemediationAI

Patch available per vendor advisory: apply the fix published in IBM support note https://www.ibm.com/support/pages/node/7274065, which supersedes Interim Fix 002 on the 8.5 branch and provides a fixed level for the 9.0 branch. If patching cannot occur immediately, the most direct compensating control is to unload mod_ibm_upload by removing or commenting out its LoadModule directive in httpd.conf and restarting the server - this fully eliminates the vulnerable code path, with the trade-off that any application relying on mod_ibm_upload for HTTP file upload handling will break and must be migrated to an alternative upload mechanism. As a secondary control, place a reverse proxy or WAF in front of IBM HTTP Server to block or rate-limit upload requests to endpoints that route through the module, accepting the cost of additional latency and a more complex request path. Confirm fix application by checking the installed iFix level against IBM's advisory.