What is the CVSS score of CVE-2026-9072?

CVE-2026-9072 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM WebSphere Plug-in are affected by CVE-2026-9072?

IBM WebSphere Application Server versions 7.3-7.6 contain a critical vulnerability in the WebServer Plug-in component that could allow attackers to gain full control over affected systems and disrupt…. A patch is available.

How to fix or mitigate CVE-2026-9072?

Within 24 hours: Identify all IBM WebSphere Application Server deployments (IBM i 7.3-7.6 and WAS/Liberty) with WebServer Plug-in and Intelligent Management enabled. Within 7 days: Apply vendor-released patch per IBM PSIRT advisory and validate in non-production environment. Within 30 days: Complete patching across all production systems and verify successful deployment.

IBM WebSphere Plug-in CVE-2026-9072

EUVD-2026-38286 CRITICAL

Code Injection (CWE-94)

2026-06-22 ibm

GHSA-m4cj-h36g-cxjg

RCE Denial Of Service IBM Code Injection

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Adjacent network and high complexity because attacker must impersonate a backend WAS server on the internal app-tier segment; no auth or UI needed; full RCE impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 23, 2026 - 21:00 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 23, 2026 - 21:00 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 23, 2026 - 20:52 vuln.today

cvss_changed

Severity Changed

Jun 23, 2026 - 20:52 NVD

HIGH CRITICAL

CVSS changed

Jun 23, 2026 - 20:52 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jun 22, 2026 - 16:02 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.

AnalysisAI

Remote code execution and denial of service in IBM WebSphere Application Server and WebSphere Application Server Liberty (including IBM i 7.3-7.6) occurs when the WebServer Plug-in component is deployed with Intelligent Management enabled. An attacker who can impersonate a backend application server and return crafted responses can trigger code injection (CWE-94) against the plug-in, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; EPSS 0.38% and SSVC exploitation 'none' indicate no observed weaponization despite the 9.8 CVSS rating.

Technical ContextAI

The IBM WebSphere WebServer Plug-in is the module loaded into front-end HTTP servers (IHS, Apache, IIS) that routes requests to backend WebSphere Application Server / Liberty JVMs. The Intelligent Management feature extends this plug-in with dynamic routing, autonomic health checks, and ODR (On Demand Router) style behavior - meaning the plug-in actively parses out-of-band control responses from backend servers in addition to plain HTTP. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code), implying the plug-in interprets attacker-controllable fields from a backend response in a way that leads to code execution in the plug-in/web-server process. CPE coverage cites cpe:2.3:a:ibm:i:*, while the EUVD record specifically names IBM i 7.3.0, 7.4.0, 7.5.0, and 7.6.0 ≤1.8.4, alongside WebSphere Application Server and Liberty deployments using Intelligent Management.

RemediationAI

Patch available per vendor advisory - apply the fixes referenced in IBM Support note https://www.ibm.com/support/pages/node/7277344 for the affected IBM i 7.3 / 7.4 / 7.5 / 7.6 releases and the corresponding WebSphere Application Server and Liberty WebServer Plug-in builds (the EUVD entry indicates IBM i 7.6 must be moved past 1.8.4); exact build numbers should be taken from IBM's advisory rather than this analysis. If immediate patching is not feasible, the most effective compensating control is disabling the Intelligent Management feature in the plug-in configuration (plugin-cfg.xml), since the vulnerability is conditional on it - the trade-off is loss of dynamic routing, on-demand routing, and autonomic health management features. Additionally, restrict the network paths between web tier plug-ins and backend WebSphere application servers using strict allow-lists, mutual TLS / SSL client authentication between IHS and WAS, and segmentation that prevents untrusted hosts from reaching the plug-in's backend response port; the trade-off is added operational complexity around certificate management.