CVE-2026-9170
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
IBM HTTP Server versions 8.5 and 9.0 are vulnerable to denial of service and potential remote code execution due to improper input validation.
Risk Assessment
An attacker could exploit this vulnerability to cause server unavailability or gain control over the server, posing a serious threat to business continuity and data security.
Recommendation
Apply the latest security updates provided by IBM for the HTTP Server immediately and implement additional input validation mechanisms.
Other vulnerabilities in IBM HTTP Server
See all- CVE-2015-4947High
A stack-based buffer overflow exists in the Administration Server of IBM HTTP Server affecting versions 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x before 8.0.0.12, and 8.5.x before 8.5.5.7. This allows remote authenticated users to execute arbitrary code.
- CVE-2026-8856High
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.
- CVE-2026-8855High
IBM HTTP Server versions 8.5 and 9.0 are vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).
- CVE-2026-8854High
Denial of service vulnerability in IBM HTTP Server versions 8.5 and 9.0 via the optional module mod_mem_cache.
- CVE-2026-8835High
IBM HTTP Server 8.5 and 9.0 is vulnerable to invalid pointer dereference. A privileged user authenticated to the Administration Server could exploit this to expose sensitive information or cause a denial of service.
- CVE-2026-8834High
IBM HTTP Server 8.5 and 9.0 contain a buffer overflow vulnerability. A privileged user authenticated to the Administration Server could exploit this to execute remote code or cause a denial of service.
- CVE-2026-8852Medium
IBM HTTP Server versions 8.5 and 9.0 are vulnerable to denial of service via the optional mod_fastcgi module.
- CVE-2026-8850High
IBM HTTP Server versions 8.5 and 9.0 are vulnerable to denial of service via the optional module mod_ibm_upload.
Original NVD description (English source)
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS