WebSphere WebServer Plug-in EUVD-2026-38346

The WebSphere WebServer Plug-in must be deployed and actively handling requests - this component is present when WebSphere Application Server is configured to front behind a separate web server (IBM HTTP Server, Apache, or IIS) rather than serving requests directly. Exploitation requires the attacker to be able to route crafted HTTP requests to the web server endpoint processed by the plug-in; if the web server is only accessible from trusted internal networks, external exploitation is blocked. The CVSS AC:H metric indicates high attack complexity, implying a specific triggering condition such as a particular request sequence, timing dependency, or protocol negotiation state must be met - this is not a simple single-packet crash. No authentication is required (PR:N), so any network-reachable client can attempt exploitation. Exploitation is limited by: (1) the AC:H precondition which prevents trivial scripted exploitation, (2) the need for the plug-in to be deployed in the architecture (not all WebSphere deployments use the external web server plug-in), and (3) the DoS-only impact which produces no persistent foothold for the attacker.

The CVSS 3.1 base score of 5.9 (Medium) reflects a meaningful but contextually bounded risk. The AV:N metric confirms the attack originates over the network and requires no authentication (PR:N), which widens the exposure surface significantly. However, AC:H is the critical moderating factor - exploitation requires conditions beyond attacker control, such as a race condition, a specific protocol negotiation state, or a non-default request pattern the plug-in parses in a specific order. This meaningfully reduces the realistic likelihood of widespread automated exploitation. The impact metrics (C:N/I:N/A:H) confirm this is a pure denial-of-service issue with no data disclosure or tampering risk, narrowing its severity for environments where availability is not mission-critical. No EPSS score was provided in the available data, limiting probabilistic exploitation forecasting. The absence of both a public proof-of-concept and a CISA KEV entry suggests this is not currently under active broad exploitation. For environments where the WebSphere WebServer Plug-in is internet-facing or serves critical workloads on IBM i, this is a genuine patching priority despite the medium score. For internal-only or non-production deployments, the risk is lower and can be addressed in standard patch cycles.

An unauthenticated remote attacker identifies a host running IBM i or WebSphere Application Server with the WebSphere WebServer Plug-in exposed on a network-accessible port. The attacker sends a sequence of specially crafted HTTP requests designed to trigger an abnormal internal state in the plug-in's request-parsing code, causing a null pointer dereference. The resulting crash terminates the plug-in process or the web server handling thread, rendering the application unavailable to legitimate users until the service is restarted.