Vulnerability · Published May 26, 2026 · Assigned by ibm
CVE-2026-8633IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins
Critical 9.8
In plain English
A critical-severity code injection in Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 39.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code execution in the Web Server Plug-ins, through a specially crafted request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty | 8.5, 9.0 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.ibm.com/support/pages/node/7274072 vendor-advisory, patch