IBM WebSphere Web Server Plug-in RCE (7.3-7.6)
CVE-2026-8858 Published on June 22, 2026

WebSphere Application Server Remote Code Execution
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Code Injection Vulnerability?

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVE-2026-8858 has been classified to as a Code Injection vulnerability or weakness.


Products Associated with CVE-2026-8858

stack.watch emails you whenever new vulnerabilities are published in IBM I or IBM WebSphere Application Server. Just hit a watch button to start following.

IBM I
 
IBM WebSphere Application Server
 

Affected Versions

IBM WebSphere Application Server: