CoreCVE
Back

CRITICAL

WebSphere Application Server Remote Code Execution

Published Jun 22, 2026

Description

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.

Affected products

Remediation

Vendor solution

IBM strongly recommends addressing the vulnerability now by applying a currently available Web Server Plug-ins interim fix or fix pack that contains the fix for APAR PH71376.

Web Server Plug-ins for IBM WebSphere Application Server (used with either WebSphere Application Server traditional or Liberty):

For V9.0.0.0 through 9.0.5.27: · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Web Server Plug-ins Interim Fix that resolves  PH71376 https://www.ibm.com/support/pages/node/7273976 --OR-- · Apply Fix Pack 9.0.5.28 or later (targeted availability 2Q2026).  

For V8.5.0.0 through 8.5.5.29: · Upgrade to minimal fix pack levels as required by interim fix and then apply Web Server Plug-ins Interim Fix that resolves  PH71376 https://www.ibm.com/support/pages/node/7273976 --OR-- · Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).

Weaknesses (1)

CWE-94

Code Injection

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner ibm
Published Jun 22, 2026
Updated Jul 9, 2026
Reserved May 20, 2026
Link CVE-2026-9072
CISA Vulnrichment
Updated Jun 22, 2026
NVD
Status Modified
Modified Jul 9, 2026
Link CVE-2026-9072
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-9072