What is the CVSS score of CVE-2026-8856?

CVE-2026-8856 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of IBM HTTP Server are affected by CVE-2026-8856?

IBM HTTP Server 8.5 and 9.0 contain a denial-of-service vulnerability (CVE-2026-8856) that could impact web server availability if exploited by an actor with write access to server configuration…. A patch is available.

How to fix or mitigate CVE-2026-8856?

Within 24 hours, identify all IBM HTTP Server 8.5 and 9.0 instances across your infrastructure. Within 7 days, obtain the vendor-released patch from IBM advisory channels and validate compatibility in non-production environments before deployment. Within 30 days, apply patches to all affected production servers following your change management process, and audit administrative access controls to server configuration directories to ensure no unauthorized write permissions exist.

IBM HTTP Server CVE-2026-8856

EUVD-2026-31903 CRITICAL

Uncontrolled Resource Consumption (CWE-400)

2026-05-26 ibm

GHSA-48g8-mw8p-w6j7

Denial Of Service IBM Http Server

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

4.4 MEDIUM

Requires attacker write access to server configuration, so PR:H and local/config vector AV:L; impact is denial of service only, giving A:H with C:N and I:N.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 11:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 11:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 11:22 NVD

HIGH CRITICAL

CVSS changed

Jul 23, 2026 - 11:22 NVD

7.7 (HIGH) 9.1 (CRITICAL)

Analysis Generated

Jun 08, 2026 - 09:38 vuln.today

DescriptionNVD

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.

AnalysisAI

Denial of service in IBM HTTP Server 8.5 and 9.0 lets an actor with write access to portions of the server configuration render the web server unavailable (CWE-400 resource exhaustion). IBM has released a fix and there is no public exploit identified at time of analysis; EPSS is negligible at 0.03% and CISA SSVC rates exploitation as 'none', indicating a low-urgency, precondition-heavy issue despite the 9.1 base score.

Technical ContextAI

IBM HTTP Server is IBM's Apache httpd-derived web server, most commonly deployed as the HTTP front end for IBM WebSphere Application Server (CPE cpe:2.3:a:ibm:http_server). The flaw is classified CWE-400 (Uncontrolled Resource Consumption): a configuration under attacker control can be manipulated so that request handling exhausts server resources and the service stops responding. Because the trigger lives in the configuration surface, the root cause is the server honoring config-driven behavior that can be abused to consume unbounded resources rather than a memory-corruption or parsing bug in a network protocol handler.

RemediationAI

Patch available per vendor advisory - apply the fix referenced in IBM support note https://www.ibm.com/support/pages/node/7274065 for both the 8.5 and 9.0 streams (for 8.5.0, apply the interim fix superseding Interim Fix 002; IBM does not publish a single semantic release number in the provided data, so confirm the exact interim-fix identifier on the advisory). As a compensating control until patched, tightly restrict write access to IBM HTTP Server configuration files and directories (httpd.conf and included fragments) to trusted administrators only using filesystem permissions, and remove any delegated or shared write access to the config tree; this directly removes the stated precondition but has the side effect of blocking legitimate delegated administration or automated config deployment. Additionally, run the server under a least-privilege service account and monitor configuration files for unauthorized changes.