CVE-2026-9072

Modified Modified - Updated After Analysis

Remote Code Execution in IBM WebSphere WebServer Plug-in

Publication date: 2026-06-22

Last updated on: 2026-07-09

Assigner: IBM Corporation

Description

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-22

Last Modified

2026-07-09

Generated

2026-07-13

AI Q&A

2026-06-22

EPSS Evaluated

2026-07-11

NVD

CVE-2026-9072

EUVD

EUVD-2026-38286

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	From 7.3 (inc) to 7.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM i versions 7.3 through 7.6, IBM WebSphere Application Server, and IBM WebSphere Application Server Liberty when using Intelligent Management with the WebSphere WebServer Plug-in component.

An attacker can exploit this vulnerability by impersonating backend servers and sending specially crafted responses to the plug-in.

This exploitation can lead to remote code execution and denial of service on the affected systems.

Mitigation Strategies

To mitigate this vulnerability, IBM recommends applying the provided PTFs specific to your IBM i version: SJ10119 for 7.3, SJ10120 for 7.4, SJ10121 for 7.5, and SJ10122 for 7.6.

Currently, there are no available workarounds for this vulnerability.

Impact Analysis

The vulnerability can have severe impacts including allowing an attacker to remotely execute arbitrary code on the affected system.

It can also cause denial of service, potentially disrupting availability of services relying on the IBM WebSphere Application Server or IBM i systems.

Because the attack requires no privileges or user interaction, it poses a significant security risk.

Hi! I’m here to help you understand CVE-2026-9072. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70