IBM HTTP Server CVE-2026-8855

Exploitation requires the target IBM HTTP Server 8.5 or 9.0 instance to be explicitly configured with TLS mutual authentication (client certificate authentication) enabled - this is the exact, non-default prerequisite named in the advisory; servers using standard one-way TLS or plain HTTP are not exposed. The limiting factors are therefore: the mTLS/client-authentication feature must be turned on, the affected version (8.5 up to Interim Fix 002, or 9.0) must be running, and the attacker must be able to reach the mTLS-protected listener over the network. Note an unresolved point: mutual authentication normally demands the client present a certificate, so whether a fully unauthenticated attacker (as the CVSS PR:N implies) or one holding a client certificate is required should be confirmed with IBM.

The signals are notably split. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) and SSVC rates Technical Impact as 'total', which argues for high priority. Counterbalancing this, SSVC records Exploitation as 'none' and Automatable as 'no', EPSS is only 0.24% (47th percentile), there is no CISA KEV listing, and no public PoC - so real-world exploitation pressure is currently low. Critically, the CVSS vector encodes AC:L and PR:N, but the description states the flaw only exists 'in configurations with TLS mutual authentication,' a non-default deployment mode; this configuration dependency is not reflected in the scored attack complexity, so the effective attack surface is narrower than 9.8 implies. Also verify with the vendor whether exploitation requires the attacker to present a valid client certificate - mutual auth by definition demands one, which would raise the real privilege barrier above the scored PR:N. Net: treat as high priority for any IBM HTTP Server instance actually running mTLS, but lower urgency for the majority of deployments that do not enable client authentication.

An attacker who can reach an IBM HTTP Server listener configured for TLS mutual authentication initiates a TLS handshake and supplies a maliciously crafted client certificate that triggers the code-injection flaw during certificate processing, resulting in code execution on the server or a crash of the service. Because the network vector is remote (AV:N) and complexity is low, a single crafted handshake could suffice; however no public exploit code has been identified at time of analysis.