What is the CVSS score of CVE-2026-8858?

CVE-2026-8858 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM WebSphere are affected by CVE-2026-8858?

IBM WebSphere Web Server Plug-in versions through 1.8.4 on IBM i platforms 7.3-7.6 contain a critical remote code execution vulnerability enabling adjacent network attackers to achieve complete…. A patch is available.

How to fix or mitigate CVE-2026-8858?

Within 24 hours: Identify all IBM i 7.3-7.6 systems running WebSphere Web Server Plug-in version 1.8.4 or earlier and assess adjacent network exposure from untrusted segments. Within 7 days: Apply vendor patch available per IBM advisory to upgrade all affected instances to patched version. Within 30 days: Verify successful patch deployment across inventory, validate WebSphere connectivity health checks, and confirm removal of vulnerable versions from production.

IBM WebSphere CVE-2026-8858

EUVD-2026-38284 HIGH

Code Injection (CWE-94)

2026-06-22 ibm

GHSA-mfq9-47xf-5654

RCE Denial Of Service IBM Code Injection

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Adjacent vector because attacker must impersonate WAS on the plug-in's network; AC:H reflects the spoofing/positioning prerequisite; PR:N and UI:N since no credentials or user action needed; full CIA impact on the plug-in host.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 23, 2026 - 21:04 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 23, 2026 - 21:02 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 23, 2026 - 20:52 vuln.today

cvss_changed

CVSS changed

Jun 23, 2026 - 20:52 NVD

7.5 (HIGH) 8.8 (HIGH)

Analysis Generated

Jun 22, 2026 - 16:02 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

AnalysisAI

Remote code execution and denial of service in the IBM WebSphere Web Server Plug-in shipped with IBM i 7.3, 7.4, 7.5, and 7.6 (through 1.8.4) allows an attacker positioned on the adjacent network to abuse the plug-in's handling of responses from an upstream WebSphere Application Server. By impersonating the application server and returning crafted responses, the attacker can trigger code injection (CWE-94) against the plug-in, leading to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and EPSS is low (0.25%), but SSVC rates the technical impact as total.

Technical ContextAI

The vulnerability resides in the WebSphere Web Server Plug-in, the native module (typically loaded into IHS/Apache or other front-end web servers) that proxies HTTP requests between the web tier and one or more WebSphere Application Server (WAS) or Liberty backends. CWE-94 (Improper Control of Generation of Code) indicates that the plug-in does not sufficiently validate or sanitize data received from the upstream WAS instance before acting on it, so a malicious or impersonated backend can influence control flow inside the plug-in process. The CPE identifies cpe:2.3:a:ibm:i (the IBM i operating environment) as the affected packaging vector, and the EUVD lists IBM i versions 7.3.0, 7.4.0, 7.5.0, and 7.6.0 with plug-in builds at or below 1.8.4 as vulnerable.

RemediationAI

Patch available per vendor advisory - apply the IBM-provided fix for the WebSphere Web Server Plug-in on IBM i 7.3, 7.4, 7.5, and 7.6 as documented at https://www.ibm.com/support/pages/node/7277344, upgrading the plug-in past the 1.8.4 vulnerable level on every web-tier host that fronts WAS or Liberty. Until patching is complete, restrict the network path between the plug-in host and the WebSphere Application Server to a dedicated, tightly ACL'd segment, require and validate mutual TLS between the plug-in and WAS so that an impersonated backend cannot complete the handshake (note that enabling mTLS may require certificate provisioning and can break health checks or third-party diagnostic proxies), and monitor for unexpected ARP/DNS changes or new listeners on the WAS port. Avoid deploying the plug-in on shared or untrusted L2 segments as a longer-term compensating control.