IBM WebSphere Application Server & Liberty Web Server Plug-ins Unauthenticated RCE and HTTP Request Smuggling (CVE-2026-8633, CVE-2026-8620) — Threadlinqs Intelligence
As of 2026-06-01, IBM WebSphere Application Server & Liberty Web Server Plug-ins Unauthenticated RCE and HTTP Request Smuggling (CVE-2026-8633, CVE-2026-8620) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 14 indicators of compromise.
Threat ID: TL-2026-0650 · Severity: CRITICAL · CVSS: 9.8 · Status: MONITORING · Category: VULNERABILITY
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5 and 9.0 contain a critical unauthenticated remote code execution flaw (CVE-2026-8633, CWE-94, CVSS 9.8) reachable via
IBM disclosed two vulnerabilities on 26 May 2026 affecting the Web Server Plug-ins component shipped with IBM WebSphere Application Server (traditional) and WebSphere Application Server Liberty, versions 8.5 and 9.0 (IBM Security Bulletin, node 7274072; tracked under APAR PH71342).
The Web Server Plug-ins are not part of the application server JVM. They are native modules (for example was_ap24_module / mod_was_ap24_http.so for Apache 2.4-based IBM HTTP Server 9.0, was_ap22_module / mod_was_ap22_http.so for Apache 2.2, plus ISAPI/NSAPI variants) that are loaded via a LoadModule directive directly into the front-end web server worker process. The plug-in reads plugin-cfg.xml, parses inbound HTTP requests, applies routing/affinity rules, and forwards matched traffic to back-end WebSphere application servers over the WCInbound transport (HTTP or HTTPS, the latter secured with the bundled GSKit SSL library). Because the plug-in runs in-process inside the web server, any memory-safety or code-generation defect in its request-parsing path executes with the privileges of the web server process — typically a low-privileged service account (apache/nobody/www on Unix, the IHS service account on Windows), but on the internet-facing edge of the environment.
CVE-2026-8633 (CVSS 3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is classified CWE-94, Improper Control of Generation of Code (Code Injection). Per NVD and IBM, an unauthenticated remote attacker can trigger arbitrary code execution in the Web Server Plug-ins by sending a specially crafted request. The combination of network attack vector, low attack complexity, and no privileges or user interaction means a single crafted HTTP request to an exposed plug-in-fronted endpoint is sufficient to attempt code execution in the web tier — a direct pathway toward back-end WebSphere systems, internal network pivoting, and data on the application server.
CVE-2026-8620 (CVSS 3.1 7.5, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) is classified CWE-444, Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling), in the same plug-in. A discrepancy in how the plug-in parses request framing (for example, ambiguous or conflicting Content-Length and Transfer-Encoding handling) versus the front-end web server or the back-end WAS allows an attacker to desynchronize the request stream, smuggle a second request past front-end inspection, poison shared connections, and reach paths or controls that perimeter defenses (WAFs, access rules) believe are protected. The Scope:Changed metric reflects that the impact crosses the trust boundary between the front-end and back-end tiers.
Analyst assessment: the two flaws reside in the same request-processing component and are plausibly chainable — request smuggling (CVE-2026-8620) to bypass perimeter inspection or reach a restricted code path, combined with the code-injection primitive (CVE-2026-8633) to achieve execution. IBM's bulletin documents the two as distinct issues remediated together and does not assert an exploit chain; the chaining here is Threadlinqs analyst hypothesis based on component co-location and the typical smuggling-to-RCE pattern, not vendor-confirmed.
As of this analysis (1 June 2026) there is no public proof-of-concept exploit, no reported in-the-wild exploitation, and neither CVE appears in the CISA Known Exploited Vulnerabilities catalog. IBM published the bulletin and an interim fix (APAR PH71342) concurrently with disclosure; permanent Fix Packs (9.0.5.28+ for the 9.0 stream, 8.5.5.30+ for the 8.5 stream) are slated for upcoming release cycles. No indicators of compromise (C2 infrastructure, malware hashes, attacker domains) have been published by any source; this record therefore documents analyst-derived behavioral and host hunting indicators rather than fabricated network artifacts.
Weaknesses (CWE)
CWE-94, CWE-444
Target sectors: financial, government, healthcare, telecommunications, retail, insurance, manufacturing
Target regions: Global, North America, Europe, Asia Pacific
Detections & IOCs
As of 2026-08-15, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 14 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-8633, CVE-2026-8620, T1595, T1190, T1059, T1505, T1211, T1552, T1082, T1083, T1210, T1071
