IBM WebSphere Plug-ins EUVD-2026-31921

Exploitation requires that the IBM Web Server Plug-in for WebSphere Application Server or WebSphere Liberty (8.5 or 9.0, at or below Interim Fix 002) is deployed in front of a WebSphere back end and reachable by the attacker over HTTP/HTTPS - typical for any internet-facing or DMZ WebSphere deployment using IHS/Apache/IIS as the front end. No authentication and no user interaction are required (PR:N/UI:N), but high attack complexity (AC:H) means the attacker must craft a request whose Content-Length/Transfer-Encoding framing is parsed differently by the upstream web server versus the plug-in, which depends on the specific front-end (IHS, Apache, or IIS) version and configuration in use. Exploitation impact is meaningfully amplified when a shared HTTP cache, load balancer, or additional reverse proxy sits in the request path; deployments without such intermediaries and without cross-tenant session reuse face a narrower exploitation surface.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N indicates a network-reachable, unauthenticated attack with high attack complexity, a Changed scope (the plug-in compromises components beyond itself), high confidentiality impact, and low integrity impact. Corroborating signals strongly suggest this is a lower real-world priority than the 7.5 base score implies: EPSS is 0.05% (15th percentile), CISA SSVC scores Exploitation as 'none' and Automatable as 'no' with only 'partial' technical impact, the vulnerability is not on the CISA KEV list, and no public exploit is identified. The high attack complexity (AC:H) is consistent with request-smuggling exploitation, which typically requires fingerprinting upstream/downstream parser quirks and chaining the desync to a useful target (cached resource, authenticated session, admin endpoint). This is best treated as a patch-during-normal-cycle item for internet-exposed plug-ins rather than an emergency, though customers fronting WebSphere with shared caches or aggregating reverse proxies should accelerate.

An attacker on the internet sends a specially crafted HTTP request to a public-facing web server hosting the WebSphere plug-in, where the front-end server and the plug-in interpret request framing differently, causing the plug-in to treat part of the request body as the start of a second request. The smuggled request can be aimed at an internal-only WebSphere endpoint, poison a shared cache entry served to other users, or hijack a queued victim request to capture session data. No public POC has been identified at time of analysis, and the high attack complexity reflects the parser-fingerprinting work an attacker must perform.