PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8855 IBM CVE debrief

IBM HTTP Server versions 8.5 (prior to 8.5.5.30) and 9.0 (prior to 9.0.5.29) contain a vulnerability in TLS mutual authentication (client authentication) configurations that enables remote code execution and denial of service. The vulnerability, published 2026-05-26, carries a CVSS 3.1 score of 8.1 (HIGH) with attack vector network, high attack complexity, and no required privileges or user interaction. The underlying weakness is categorized as CWE-94 (Improper Control of Generation of Code). Affected platforms include AIX, z/OS, Linux, and Windows deployments of IBM HTTP Server. IBM has released a vendor advisory with remediation guidance.

Vendor
IBM
Product
HTTP Server
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-07-23
Advisory published
2026-05-26
Advisory updated
2026-07-23

Who should care

Organizations running IBM HTTP Server 8.5 or 9.0 with TLS mutual authentication enabled, particularly those in regulated industries requiring strong client authentication. System administrators, security engineers, and compliance teams responsible for web server infrastructure and TLS configuration management.

Technical summary

The vulnerability exists in IBM HTTP Server's handling of TLS mutual authentication. When client authentication is enabled, an attacker can exploit improper code generation controls (CWE-94) to achieve remote code execution or cause denial of service. The attack requires network access but is mitigated by high attack complexity. No privileges or user interaction are required. The vulnerability affects all platforms where IBM HTTP Server 8.5.x before 8.5.5.30 and 9.0.x before 9.0.5.29 are deployed with TLS client authentication enabled.

Defensive priority

HIGH

Recommended defensive actions

  • Review IBM HTTP Server deployments for TLS mutual authentication (client authentication) configurations.
  • Upgrade IBM HTTP Server to version 8.5.5.30 or later for 8.5.x deployments, or version 9.0.5.29 or later for 9.0.x deployments.
  • If immediate patching is not feasible, consider disabling TLS mutual authentication as a temporary risk reduction measure, understanding this may impact authentication requirements.
  • Monitor IBM security bulletins for additional remediation guidance.
  • Review access logs for anomalous TLS handshake patterns or client certificate authentication attempts that may indicate exploitation attempts.

Evidence notes

CVE published 2026-05-26T18:16:57.170Z; modified 2026-05-26T20:25:33.130Z. CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. CPE criteria confirm affected versions 8.5.0.0 through 8.5.5.29 and 9.0.0.0 through 9.0.5.28. Not listed in CISA KEV.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8855 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8855

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8855 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8855

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.