What is the CVSS score of EUVD-2026-31905?

EUVD-2026-31905 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM HTTP Server are affected by EUVD-2026-31905?

IBM HTTP Server versions 8.5 and 9.0 with TLS mutual authentication contain a critical remote code execution vulnerability (CVSS 9.8) that could allow unauthenticated network attackers to fully…. A patch is available.

How to fix or mitigate EUVD-2026-31905?

Within 24 hours: Identify all IBM HTTP Server 8.5 and 9.0 instances with TLS client certificate authentication enabled in your environment and prioritize them for patching. Within 7 days: Apply the vendor-released patch to all affected servers, starting with production systems, and verify successful deployment through version checks. Within 30 days: Complete patching across all remaining instances including development and test environments, then validate TLS mutual authentication functionality post-patch to ensure no service disruption.

IBM HTTP Server EUVD-2026-31905

| CVE-2026-8855 CRITICAL

Code Injection (CWE-94)

2026-05-26 ibm

GHSA-rjqm-vgmr-8cp8

Denial Of Service Code Injection IBM RCE Http Server

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network vector and total impact justify C/I/A:H, but the required non-default TLS mutual-authentication configuration warrants AC:H rather than the vendor's AC:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 11:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 11:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 11:22 NVD

HIGH CRITICAL

CVSS changed

Jul 23, 2026 - 11:22 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jun 08, 2026 - 10:11 vuln.today

DescriptionNVD

IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).

AnalysisAI

Remote code execution and denial of service affect IBM HTTP Server 8.5 and 9.0 when deployed with TLS mutual (client certificate) authentication enabled. The flaw is a code injection weakness (CWE-94) that a network-based attacker can leverage to fully compromise confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.24%, 47th percentile), indicating no observed weaponization yet despite the maximal 9.8 CVSS.

Technical ContextAI

IBM HTTP Server is IBM's web server, historically derived from the Apache HTTP Server codebase and commonly fronting IBM WebSphere Application Server deployments. The affected component per CPE is cpe:2.3:a:ibm:http_server (versions 8.5 and 9.0). The vulnerability class is CWE-94 (Improper Control of Generation of Code / Code Injection), meaning attacker-influenced data is interpreted as executable code. The defect manifests specifically in the TLS mutual-authentication (client certificate authentication) code path - the handshake stage where the server processes and validates a presented client certificate - rather than in general request handling, which is why only mTLS-configured deployments are exposed.

RemediationAI

Patch available per vendor advisory: apply the fix distributed through IBM support bulletin https://www.ibm.com/support/pages/node/7274065, which supersedes 8.5.0 Interim Fix 002 for the 8.5 stream and provides a corresponding update for 9.0 (apply the interim fix / fix pack IBM designates for your version - confirm the exact build against the advisory as the specific fixed version is not stated in the available data). As a compensating control until patched, disable TLS mutual authentication (client certificate authentication) on affected virtual hosts by removing the SSLClientAuth 'required' directive, which fully closes the vulnerable code path but has the side effect of removing certificate-based client authentication and any access control that depends on it. Where mTLS cannot be disabled, restrict network reachability of the mTLS-enabled listener to trusted client networks via firewall or reverse-proxy ACLs to limit which hosts can reach the vulnerable handshake, accepting that this narrows but does not eliminate exposure for authorized clients.