EUVD-2026-38286
GHSA-m4cj-h36g-cxjg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain foothold on internal app-tier network
-
DeliveryIdentify plug-in with Intelligent Management enabled
-
ExploitImpersonate registered backend WebSphere server
-
ExecutionSend crafted Intelligent Management response
-
PersistTrigger CWE-94 code injection in plug-in
-
ImpactExecute code in web server process or crash plug-in
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concrete prerequisites drawn from the description: (1) a target deployment of IBM WebSphere Application Server, WebSphere Application Server Liberty, or IBM i 7.3/7.4/7.5/7.6 that uses the WebSphere WebServer Plug-in, (2) the Intelligent Management feature must be explicitly enabled in the plug-in configuration - default plug-in deployments without Intelligent Management are not affected, and (3) the attacker must achieve a network position that lets them impersonate one of the configured backend WebSphere application servers to the plug-in (typically meaning ARP/DNS/IP spoofing on the internal app-tier network, or otherwise hijacking the backend response channel). No user interaction or prior authentication to the plug-in is required (CVSS PR:N/UI:N), but the backend-impersonation requirement is a real limiting factor that pure CVSS 9.8 does not convey. |
| Impact | Signals diverge sharply: NVD CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A all High), yet EPSS exploitation probability is only 0.38% (30th percentile) and CISA SSVC reports Exploitation=none and Automatable=no with Technical Impact=total. There is no CISA KEV listing and no public exploit identified at time of analysis. The CVSS network-vector framing is also somewhat optimistic for an attacker: the description requires impersonating a backend WebSphere server to the plug-in, which in most deployments is a segmented internal interface, not an internet-facing endpoint - so AV:N is technically defensible but real-world reachability is usually much narrower. Net assessment: this is a legitimately high-impact bug for organizations running WebSphere Intelligent Management, but not a drop-everything zero-day; prioritize patching where Intelligent Management is in use, especially if backend network segmentation is weak. |
| Exploit ScenarioDerived | An attacker who has gained a foothold on the internal network segment between the web tier and WebSphere backends (for example via a compromised internal host or an SSRF primitive in another app) spoofs the IP/port of a registered WAS backend server and waits for the plug-in to send a request. They reply with a crafted Intelligent Management response containing the malicious payload that triggers CWE-94 code injection in the plug-in process, achieving code execution inside the front-end HTTP server (or crashing it for denial of service). No public exploit is identified at time of analysis, so the scenario requires the attacker to build the primitive from the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 23, 2026
Remote code execution and denial of service in IBM WebSphere Application Server and WebSphere Application Server Liberty (including IBM i 7.3-7.6) occurs when the WebServer Plug-in component is deployed with Intelligent Management enabled. An attacker who can impersonate a backend application server and return crafted responses can trigger code injection (CWE-94) against the plug-in, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; EPSS 0.38% and SSVC exploitation 'none' indicate no observed weaponization despite the 9.8 CVSS rating.
Earlier versions of this analysis (2)
Remote code execution and denial of service in the IBM WebSphere WebServer Plug-in component affects IBM i 7.3-7.6 and IBM WebSphere Application Server (including Liberty) deployments that use the Intelligent Management feature. An unauthenticated network attacker who can impersonate a backend application server and return crafted responses to the plug-in can achieve code execution or crash the fronting web server. No public exploit identified at time of analysis, and EPSS estimates a low 0.38% near-term exploitation probability.
Remote code execution and denial of service in the IBM WebSphere WebServer Plug-in component, when deployed with Intelligent Management on IBM i 7.3-7.6 and IBM WebSphere Application Server (traditional and Liberty), allows an attacker who can impersonate a backend application server to deliver crafted responses that trigger code injection in the plug-in process. CVSS 8.1 reflects high impact with high attack complexity due to the man-in-the-middle position required, and no public exploit identified at time of analysis.
RemediationAI
Patch available per vendor advisory - apply the fixes referenced in IBM Support note https://www.ibm.com/support/pages/node/7277344 for the affected IBM i 7.3 / 7.4 / 7.5 / 7.6 releases and the corresponding WebSphere Application Server and Liberty WebServer Plug-in builds (the EUVD entry indicates IBM i 7.6 must be moved past 1.8.4); exact build numbers should be taken from IBM's advisory rather than this analysis. If immediate patching is not feasible, the most effective compensating control is disabling the Intelligent Management feature in the plug-in configuration (plugin-cfg.xml), since the vulnerability is conditional on it - the trade-off is loss of dynamic routing, on-demand routing, and autonomic health management features. Additionally, restrict the network paths between web tier plug-ins and backend WebSphere application servers using strict allow-lists, mutual TLS / SSL client authentication between IHS and WAS, and segmentation that prevents untrusted hosts from reaching the plug-in's backend response port; the trade-off is added operational complexity around certificate management.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The IBM WebSphere WebServer Plug-in is the module loaded into front-end HTTP servers (IHS, Apache, IIS) that routes requests to backend WebSphere Application Server / Liberty JVMs. The Intelligent Management feature extends this plug-in with dynamic routing, autonomic health checks, and ODR (On Demand Router) style behavior - meaning the plug-in actively parses out-of-band control responses from backend servers in addition to plain HTTP. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code), implying the plug-in interprets attacker-controllable fields from a backend response in a way that leads to code execution in the plug-in/web-server process. CPE coverage cites cpe:2.3:a:ibm:i:*, while the EUVD record specifically names IBM i 7.3.0, 7.4.0, 7.5.0, and 7.6.0 ≤1.8.4, alongside WebSphere Application Server and Liberty deployments using Intelligent Management.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent network and high complexity because attacker must impersonate a backend WAS server on the internal app-tier segment; no auth or UI needed; full RCE impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.
Executive ViewAI
IBM WebSphere Application Server versions 7.3-7.6 contain a critical vulnerability in the WebServer Plug-in component that could allow attackers to gain full control over affected systems and disrupt business operations. While no public exploit has been identified at the time of this analysis, the severity of the vulnerability and the prevalence of WebSphere across enterprise deployments make immediate patching critical to prevent potential system compromise and service disruption.
Apply vendor patch. Interim mitigations while patching is underway: disable Intelligent Management in WebServer Plug-in if not operationally required; implement network controls to restrict communications between WebServer Plug-in and backend application servers to trusted networks only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB