IBM WebSphere Plug-ins EUVD-2026-31927

The target web server (IBM HTTP Server, Apache, or IIS) must be running the IBM Web Server Plug-in module for WebSphere Application Server or WebSphere Liberty at version 8.5 or 9.0 and must be reachable over the network from the attacker - typical for internet-facing or DMZ-deployed WebSphere front-ends. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special access prerequisites are required, and exploitation works against default plug-in deployments serving HTTP/HTTPS traffic. Limiting factors are narrow: organizations that have already segmented the plug-in host behind a strict WAF, that do not expose the plug-in to untrusted networks, or that have already upgraded to a fixed build per IBM's advisory are not exposed; the vulnerability does not require a specific non-default WebSphere configuration based on available data.

The signals are mixed and warrant careful prioritization. CVSS v3.1 AV:N/AC:L/PR:N/UI:N indicates a worst-case profile - network-reachable, low complexity, no privileges, no user interaction - and SSVC Technical Impact is 'total' with Automatable=yes, both consistent with the 9.8 score. However, EPSS is only 0.20% (42nd percentile) and SSVC Exploitation status is 'none', and no public exploit identified at time of analysis, which contrasts sharply with the theoretical severity. This pattern (high CVSS, low EPSS, no observed exploitation) typically reflects a newly disclosed RCE in an enterprise product where exploit development has not yet matured publicly; given the plug-in sits at the web tier and IBM WebSphere is widely deployed in financial and government environments, defenders should treat patching as high priority despite the currently quiet exploit landscape.

An unauthenticated remote attacker sends a specially crafted HTTP request to a web server (such as IBM HTTP Server, Apache, or IIS) loading the vulnerable WebSphere plug-in module; the plug-in mishandles the request in a way that triggers code injection (CWE-94), causing arbitrary code to execute in the context of the web server process. The attacker then leverages this foothold at the web tier - typically a high-value DMZ host - to pivot toward back-end WebSphere applications and connected databases. No public exploit has been identified at time of analysis, but SSVC marks the issue as automatable, implying exploit development would likely be straightforward once the vulnerable code path is reverse-engineered from the patch.