IBM HTTP Server CVE-2026-8852

Exploitation requires that the target IBM HTTP Server (8.5.0 ≤ Interim Fix 002, or 9.0) has the OPTIONAL mod_fastcgi module enabled and network-reachable - this is the decisive prerequisite, as default installations without FastCGI configured are not exposed. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed once the module is present and accessible. Limiting factors: the non-default module requirement significantly narrows the exploitable population, and impact is confined to denial of service (no code execution or data access), with SSVC rating exploitation as none and not automatable.

Signals are consistent and point to a genuine but low-to-moderate priority. The CVSS 3.1 base score is 7.5 (High) driven entirely by availability (AV:N/AC:L/PR:N/UI:N/A:H), meaning network-reachable, unauthenticated, low-complexity DoS. However, corroborating exploitation signals are weak: EPSS is 0.03% (9th percentile), SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no KEV listing and no public PoC. A key nuance the raw 7.5 hides is that mod_fastcgi is an OPTIONAL module - servers not configured to use FastCGI are not exposed, so real-world attack surface is narrower than AV:N/PR:N implies. Net: patch in normal cycles; this is not an emergency for most deployments, and installations that do not use mod_fastcgi are effectively unaffected.

An attacker who can reach the HTTP Server over the network sends crafted requests to an endpoint served by the optional mod_fastcgi module, triggering a reachable assertion that abnormally terminates the handling process and denies service to legitimate users. No authentication or user interaction is required per the CVSS vector, but the target must have mod_fastcgi enabled. No public exploit code has been identified, so an attacker would need to develop the trigger independently.