What is the CVSS score of CVE-2026-8855?

CVE-2026-8855 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM HTTP Server are affected by CVE-2026-8855?

IBM HTTP Server versions 8.5 and 9.0 contain a remote code execution vulnerability accessible to unauthenticated network attackers when configured with TLS mutual (client certificate) authentication.. A patch is available.

How to fix or mitigate CVE-2026-8855?

24 hours: Inventory IBM HTTP Server 8.5 and 9.0 deployments, prioritizing systems configured with TLS mutual authentication. 7 days: Apply patch from IBM advisory node/7274065 to all affected instances. 30 days: Verify patch deployment and monitor application logs for exploitation attempts.

IBM HTTP Server CVE-2026-8855

EUVD-2026-31905 HIGH

Code Injection (CWE-94)

2026-05-26 ibm

GHSA-rjqm-vgmr-8cp8

RCE Denial Of Service IBM Code Injection Http Server

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:11 vuln.today

DescriptionCVE.org

IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).

AnalysisAI

Remote code execution and denial of service in IBM HTTP Server 8.5 and 9.0 affects deployments configured with TLS mutual (client certificate) authentication, where an attacker can trigger code injection (CWE-94) over the network without prior authentication. The flaw carries a CVSS 8.1 score with high attack complexity, and IBM has published a patch (advisory node/7274065); no public exploit has been identified at time of analysis and SSVC marks exploitation as 'none' with total technical impact.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify IHS endpoint requiring client certs

Delivery

Craft malicious X.509 client certificate

Exploit

Initiate TLS handshake with crafted cert

Execution

Trigger code injection in mTLS handler

Persist

Execute code or crash server process

Impact

Pivot into WebSphere backend

Access

Identify IHS endpoint requiring client certs

Delivery

Craft malicious X.509 client certificate

Exploit

Initiate TLS handshake with crafted cert

Execution

Trigger code injection in mTLS handler

Persist

Execute code or crash server process

Impact

Pivot into WebSphere backend

Vulnerability AssessmentAI

Exploitation	The target IBM HTTP Server 8.5 or 9.0 instance must be explicitly configured for TLS mutual authentication - i.e., SSLClientAuth set to 'required' or 'optional' on a virtual host so that the server requests and processes client X.509 certificates during the TLS handshake. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed and point to a serious-but-not-imminent issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker reachable on the network to an IHS instance configured with SSLClientAuth opens a TLS connection and presents a specially crafted X.509 client certificate that triggers the code-injection flaw during mutual-authentication processing, yielding code execution in the IHS process context or crashing the server. Because no public exploit has been identified at time of analysis and SSVC marks exploitation as 'none', the realistic near-term scenario is a targeted attack against a known mTLS-fronted enterprise endpoint (e.g., a B2B portal or WebSphere admin entrypoint) rather than mass scanning.
Remediation	Apply the IBM-released fix referenced in the vendor advisory at https://www.ibm.com/support/pages/node/7274065, which supersedes 8.5.0 Interim Fix 002 and patches the 9.0 branch - exact fix-pack labels should be taken from that page as IBM ships IHS updates as cumulative fix packs rather than discrete version bumps. … Detailed patch versions, workarounds, and compensating controls in full report.