CVE-2026-8855: IBM HTTP Server is affected by multiple vulnerabilities
IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM System z Security (System z customers)to a version that resolves this vulnerability.Fixed in 8.5.5.30Patch PH71265 - Upgrade
Upgrade
IBM System z Security (System z customers)to a version that resolves this vulnerability.Fixed in 9.0.5.29Patch PH71265 - Compensating control
For IBM HTTP Server deployments using TLS mutual authentication (client authentication), mitigate exposure by avoiding or disabling TLS client authentication until a fix pack or interim fix containing APAR PH71265 is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8855?
CVE-2026-8855 has a critical severity rating of 9.8.
How do I fix CVE-2026-8855?
To fix CVE-2026-8855, apply the currently available interim fix or fix pack that addresses APAR PH71265.
What systems are affected by CVE-2026-8855?
CVE-2026-8855 affects IBM HTTP Server versions 8.5 and 9.0 configured with TLS mutual authentication.
What types of vulnerabilities are associated with CVE-2026-8855?
CVE-2026-8855 is associated with remote code execution and denial of service vulnerabilities.
What is the risk rating of CVE-2026-8855?
CVE-2026-8855 carries a risk rating of 61.