Critical IBM WebSphere CVE-2024-22987 Lets Attackers Remotely Execute Code

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-8633, has been discovered in IBM WebSphere Application Server.
• The flaw specifically impacts environments utilizing the optional Web Server Plug-ins component for both traditional WebSphere and WebSphere Liberty deployments.
• With a CVSS score of 9.8, the vulnerability allows unauthenticated, remote attackers to execute arbitrary code and gain full control over affected systems.
• IBM has released remediation guidance and interim fixes; organizations are strongly advised to patch immediately.

A severe security vulnerability has been identified in IBM’s widely used WebSphere Application Server, posing a significant risk to enterprise infrastructure. This critical flaw, designated CVE-2026-8633, could enable malicious actors to execute arbitrary code remotely by submitting specially crafted HTTP requests.

The vulnerability primarily affects deployments that incorporate the optional Web Server Plug-ins component, which is common in many large-scale WebSphere installations. This elevates the potential for widespread impact across government and enterprise networks globally.

Assigned a critical CVSS score of 9.8, the flaw permits unauthenticated, remote exploitation. This means attackers can gain complete control of vulnerable systems without needing prior access or credentials, leading to potential compromise of confidentiality, integrity, and availability.

Given the extensive adoption of IBM WebSphere in critical enterprise and government systems, the exposure presented by this vulnerability is considered extremely high.

IBM WebSphere RCE Vulnerability Details

The core of the issue stems from improper control over code generation, categorized under CWE-94. This weakness allows attackers to inject malicious payloads into the system via carefully constructed HTTP requests. When these requests are processed by the vulnerable Web Server Plug-ins, they can trigger remote code execution.

Beyond direct RCE, the vulnerability also introduces the risk of HTTP request smuggling. This technique allows attackers to bypass security controls and manipulate communications between the web server and backend application server, potentially facilitating further attacks or unauthorized access.

Affected Versions and Components

CVE-2026-8633 specifically targets IBM Web Server Plug-ins used in conjunction with both traditional WebSphere Application Server and WebSphere Liberty environments. Affected versions include:

• WebSphere Application Server 8.5 and 9.0
• WebSphere Liberty 8.5 and 9.0

Corresponding plug-in versions for these platforms are also impacted. Since these plug-ins are commonly deployed to route traffic between external web servers and internal application servers, successful exploitation could provide attackers with a direct path into an organization’s backend systems.

What You Should Do

• Apply Interim Fixes Immediately: IBM strongly advises applying interim fixes that address APAR PH71342 after upgrading to the necessary minimum fix pack levels.
• Upgrade WebSphere Application Server:
  • For WebSphere 9.0 environments, upgrade to Fix Pack 9.0.5.28 or a later version once available.
  • For WebSphere 8.5 environments, update to Fix Pack 8.5.5.30 or a later version when released.
• Monitor HTTP Traffic: Implement robust monitoring for HTTP traffic, specifically looking for anomalies, malformed requests, or unexpected patterns that could indicate exploitation attempts.
• Restrict External Access: Limit external access to WebSphere plug-in endpoints as much as possible.
• Deploy Web Application Firewalls (WAFs): Utilize WAFs to provide an additional layer of protection against malicious HTTP requests and known attack patterns.
• Initiate Threat Hunting: Conduct proactive threat hunting within your environments to identify any signs of compromise that may have occurred prior to patching.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.