IBM HTTP Server CVE-2026-8854

The target IBM HTTP Server instance (8.5 ≤ Interim Fix 002, or 9.0) must have the optional mod_mem_cache module loaded and active - this is not enabled by default in typical IHS deployments, which is the primary limiting factor. The HTTP listener must be reachable from the attacker's network position (CVSS AV:N), but no authentication, user interaction, or elevated privileges are required (PR:N/UI:N). Impact is limited to availability (C:N/I:N/A:H) - no path to data disclosure or code execution is described, so exploitation only yields service disruption against caches-enabled deployments.

Signals are mixed and lean toward moderate-but-not-urgent priority. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) confirms network-reachable, unauthenticated triggering with availability-only impact - no data exposure or code execution. EPSS at 0.01% (3rd percentile) and SSVC exploitation status of 'none' indicate no observed in-the-wild activity, while SSVC 'Automatable: yes' warns that scripted abuse is feasible once a technique is published. The vulnerability is gated by a non-default condition: mod_mem_cache must be explicitly loaded, which materially shrinks the exposed population versus the raw CVSS would suggest. No CISA KEV listing and no public PoC identified, so this is a patch-on-normal-cycle issue rather than an emergency, unless mod_mem_cache is in use on internet-facing instances.

An unauthenticated remote attacker sends a sequence of crafted HTTP requests to an internet-facing IBM HTTP Server instance that has mod_mem_cache enabled, triggering the expired pointer dereference during cache lookup or eviction. The worker process crashes; repeated requests sustain the denial-of-service, knocking the fronted WebSphere application offline. No public exploit identified at time of analysis, but SSVC marks the technique as automatable once disclosed.