CVE-2026-9072: IBM WebSphere WebServer Plug-in Code Injection and Denial of Service
IBM has published CVE-2026-9072 affecting WebSphere Application Server and WebSphere Application Server Liberty when used with Intelligent Management and the WebSphere WebServer Plug-in. The record describes remote code execution and denial of service that can be triggered when an attacker impersonates backend servers and sends crafted responses to the plug-in. NVD scores it 9.8 (critical) under CVSS 3.1, but the record's affected-product field does not match the WebSphere description, so scope should be confirmed with the IBM bulletin.
Overview
CVE-2026-9072 is described as affecting IBM WebSphere Application Server and WebSphere Application Server Liberty when the Intelligent Management feature is used with the WebSphere WebServer Plug-in. The record associates the flaw with remote code execution and denial of service. The CWE assigned is CWE-94 (Code Injection).
Impact
- The record reports remote code execution and denial of service.
- The described trigger is an attacker impersonating backend servers and returning crafted responses to the plug-in.
- NVD rates the issue 9.8 (critical) under CVSS 3.1 with a network attack vector and no privileges or user interaction required. IBM's own score in the record is 8.1 under CVSS 3.1.
Affected products and versions
The record's affected field lists the product as 'Ibm I' with versions from 7.3 through 7.6. This does not match the WebSphere description in the same record, so the affected product and version range are unverified from the data available. Consult the IBM bulletin before drawing conclusions about your environment.
Exploitation status
The record shows no CISA KEV listing and no EPSS data. Based on the sources consulted, no confirmed exploitation in the wild is reported.
Remediation and mitigation
- Check the IBM support bulletin referenced in the record for the official fix guidance and fixed levels. The record does not list any fixed version.
- Inventory WebSphere Application Server, Liberty and WebServer Plug-in deployments, and confirm whether Intelligent Management is in use.
- Until fixes are applied, limit which backend endpoints the plug-in can trust and restrict network paths between the web tier and backend servers, reducing the opportunity for impersonation.
Detection guidance
- Review plug-in and web server logs for unexpected backend connection failures, malformed responses or abrupt process restarts.
- Monitor for anomalous traffic between the plug-in and backend hosts, especially from unexpected sources.
Limitations of the available information
- The record has no fixed versions, no vendor-stated affected range consistent with the WebSphere description, and no EPSS score.
- The IBM PSIRT score (8.1) and the NVD score (9.8) differ; the reason is not stated in the record.
- Technical details of the exploitation path beyond the summary are not provided.
Frequently asked questions
What is CVE-2026-9072?
It is a vulnerability record for IBM WebSphere Application Server and Liberty used with Intelligent Management and the WebSphere WebServer Plug-in, describing remote code execution and denial of service.
Is this vulnerability known to be actively exploited?
The record shows no CISA KEV listing, and no confirmed exploitation in the wild appears in the sources consulted.
Which versions are fixed?
The record does not list any fixed versions. Check the IBM support bulletin referenced in the record for official guidance.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.