CVE-2026-8620: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to HTTP request smuggling in the Web Server Plug-ins through a specially crafted request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Web Server Plug-ins for IBM WebSphere Application Server and WebSphere Application Server Liberty (8.5/9.0)to a version that resolves this vulnerability.Fixed in 8.5.5.30 - Upgrade
Upgrade
IBM Web Server Plug-ins for IBM WebSphere Application Server and WebSphere Application Server Liberty (8.5/9.0)to a version that resolves this vulnerability.Fixed in 9.0.5.28 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch PH71342
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8620?
CVE-2026-8620 has a severity rating of high with a score of 7.5.
How do I fix CVE-2026-8620?
To fix CVE-2026-8620, apply the interim fix or fix pack that contains the fix for APAR PH71342.
What products are affected by CVE-2026-8620?
CVE-2026-8620 affects IBM Web Server Plug-ins for both WebSphere Application Server and WebSphere Application Server Liberty.
What type of vulnerability is CVE-2026-8620?
CVE-2026-8620 is categorized as an HTTP request smuggling vulnerability.
What are the potential impacts of CVE-2026-8620?
The potential impacts of CVE-2026-8620 include unauthorized access and potential application data compromise.