IBM WebSphere Plug-ins CVE-2026-9170

Exploitation requires that the target deploys the IBM Web Server Plug-ins (versions tied to WebSphere 8.5 or 9.0) between an HTTP server (IHS, Apache HTTP Server, or IIS) and a WebSphere Application Server or Liberty back-end, and that the fronted HTTP endpoint is reachable by the attacker over the network - typical for Internet-facing WebSphere deployments. No authentication and no user interaction are needed (PR:N/UI:N), and the attack works against the default plug-in configuration since the flaw is in request parsing itself. Limiting factors: targets that terminate HTTP/1.1 at a hardened upstream proxy that strictly enforces RFC 7230 framing, or that have already applied the IBM interim fix, will not be exploitable; pure HTTP/2 end-to-end paths that never reach the plug-in's HTTP/1.1 parser are also out of scope, and the description's 'potential' qualifier on RCE implies code execution likely depends on the specific back-end application or plug-in version rather than being guaranteed.

Signals are mixed and warrant nuanced prioritization. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects a worst-case unauthenticated network RCE, and SSVC marks Technical Impact as total and Automatable as yes - consistent with how request smuggling can be scripted against any exposed endpoint. However, SSVC Exploitation is rated 'none', the vuln is not in CISA KEV, and EPSS sits at 0.06% (19th percentile), indicating no observed exploitation and limited public attacker interest so far. The description hedges with 'potential remote code execution', so RCE may require chaining smuggling with a downstream gadget rather than being a single-shot primitive; DoS is the more certain outcome. Treat this as a high-priority patch for any Internet-facing WebSphere fronted by the plug-in, but the absence of public exploit code and IBM's pre-emptive disclosure suggest defenders have a window before opportunistic mass exploitation.

An unauthenticated attacker on the Internet sends an HTTP request with ambiguous Content-Length and Transfer-Encoding headers to a public IHS/Apache server fronting WebSphere; the front-end and the plug-in parse the boundary differently, causing the plug-in to forward a smuggled second request to the back-end Liberty/WAS instance. By poisoning the connection pool, the attacker can hijack other users' sessions, bypass authentication on internal endpoints, or trigger memory-corruption paths in the plug-in's malformed-input handling that lead to crash (DoS) or, in chained scenarios, code execution. No public PoC is published yet, but request-smuggling templates are widely available and SSVC rates exploitation as automatable.