CVE-2026-8633

CriticalCVSS 9.8/10Last modified Jul 23, 2026

Description

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code execution in the Web Server Plug-ins, through a specially crafted request.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 26, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-863307.2An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible CVE-2026-863326.5A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes CVE-2026-863344.2Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on CVE-2026-863356.3Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to acces CVE-2026-863386.0Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced i CVE-2026-86349.1Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or comprom CVE-2026-863414.4GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that,CVE-2026-863424.3Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlatio CVE-2026-863447.5A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an inc CVE-2026-863459.0A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating Star CVE-2026-863476.5Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploa CVE-2026-863484.3Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash