IBM WebSphere: code execution in Web Server Plug-ins (CVE-2026-8633)

Remote code execution in WebSphere Application Server and Liberty Web Server Plug-ins, CVSS 9.8. Apply the IBM fix.

On 26 May 2026 the record for CVE-2026-8633 was published, a remote code execution vulnerability in the Web Server Plug-ins for IBM WebSphere Application Server and WebSphere Liberty. The NVD score is CVSS v3.1 9.8. The affected versions are 8.5 and 9.0.

The flaw is in a component between the web server and the application: for this reason an instance can be exposed even when the application itself is up to date. The cause is code generation from unsanitised input (CWE-94).

Apply the IBM fix described in the advisory and check the plug-in version on all web servers that forward traffic to WebSphere, including staging ones.

At a glance

What: Remote code execution in the Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty, through a crafted request.
Severity: CVSS v3.1 9.8 (critical), according to NVD.
Affected versions: WebSphere Application Server and Liberty 8.5 and 9.0, according to the IBM advisory.
Cause: Code generation from unsanitised input (CWE-94).
Action: Apply the IBM fix in the advisory, checking the version of the plug-ins installed on web servers.

Sources: NVD, CVE-2026-8633 · IBM, avviso di sicurezza

← All articles