CVE-2026-8855CWE-94

IBM HTTP Server is affected by multiple vulnerabilities

High · published May 26, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00848 · 57.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-05-26T16:58Z
EPSS history
Timeline
  • 26 MAY 16:58Z
    IBM HTTP Server is affected by multiple vulnerabilities
    cvelistv5