IBM WebSphere EUVD-2026-38284

Attacker must be on the same adjacent network segment as the WebSphere Web Server Plug-in host and able to impersonate the upstream IBM WebSphere Application Server or WAS Liberty instance (e.g., via ARP/DNS spoofing, a compromised adjacent host, or sitting on the plug-in-to-WAS path), and must induce the plug-in to process a crafted response from the spoofed backend; the affected configuration is any IBM i 7.3/7.4/7.5/7.6 deployment running the WebSphere Web Server Plug-in at version ≤1.8.4. Limiting factors: AV:A means this is not exploitable from the internet without prior internal access, no user interaction is required (UI:N) and no authentication to the plug-in is required (PR:N), but mutual TLS between the plug-in and WAS - where deployed - would prevent the impersonation step.

The 8.8 CVSS base score and the SSVC 'total' technical impact rating both signal that successful exploitation yields a complete takeover of the web-server/plug-in process, which typically runs with significant privileges in front of business-critical Java workloads. However, the CVSS vector is AV:A (adjacent network), not AV:N, meaning the attacker must already be in a position to intercept or impersonate WAS-to-plug-in traffic - usually the internal segment between the web tier and the application tier - which is a meaningful pre-condition. SSVC reports Exploitation: none and Automatable: no, EPSS is only 0.25% (16th percentile), and there is no public exploit identified at time of analysis, so this is not a mass-scanning target today; the real risk is targeted use by an attacker who has already gained an internal foothold or who can perform ARP/DNS/route manipulation on the WAS segment. CVSS PR:N is consistent with the description (no credentials are needed to send crafted responses once positioned), but defenders should weigh the adjacency requirement before treating this at the same urgency as an internet-facing RCE.

An attacker who has gained a foothold on the internal network between an IHS/Apache front-end and the WebSphere Application Server (for example via a compromised adjacent host, ARP spoofing, or rogue DHCP) impersonates the legitimate WAS endpoint and replies to plug-in requests with a crafted response that triggers the code-injection flaw inside the plug-in process. Successful exploitation lets the attacker execute arbitrary code in the context of the web-tier server or crash the plug-in to deny service to all hosted applications. No public exploit identified at time of analysis, so any near-term use would be bespoke.