CVE-2026-8855 is a high severity (CVSS 8.1) code injection flaw in IBM HTTP Server 8.5 and 9.0. Servers configured for TLS mutual authentication can suffer remote code execution or denial of service. IBM says to apply the interim fix for APAR PH71265, or fix pack 9.0.5.29 or 8.5.5.30.
What's affected
IBM's bulletin lists IBM HTTP Server 8.5 and 9.0, the Apache based server bundled with IBM WebSphere Application Server and other products. The record says the issue applies in configurations with TLS mutual authentication, also called client authentication.
IBM's remediation, for the server used with WebSphere Application Server:
- V9.0.0.0 through 9.0.5.28: apply the interim fix for PH71265 on a supported fix pack level, or apply fix pack 9.0.5.29 or later
- V8.5.0.0 through 8.5.5.29: apply the interim fix for PH71265, or apply fix pack 8.5.5.30 or later
IBM gave a targeted availability of the third quarter of 2026 for those fix packs. IBM also lists no workarounds or mitigations.
The same bulletin covers several other IBM HTTP Server CVEs, so applying the fix addresses more than this one.
How to check if you're exposed
Find the version of IBM HTTP Server on each host. IBM ships a version information script with its products, usually in the bin folder of the install, and the version also appears in the server banner if you have not hidden it. You can also read the installed fix pack from your WebSphere inventory.
Then search the server configuration for client authentication settings:
grep -rn "SSLClientAuth" /path/to/IHS/conf
The directive name is the one used by IBM's SSL module, but check IBM's documentation for your version. If a virtual host asks clients for certificates, it is in the described configuration.
What to do now
- Read the IBM bulletin and APAR PH71265 and note the interim fix for your fix pack level.
- Apply the interim fix, or move to fix pack 9.0.5.29 or 8.5.5.30 or later.
- List every virtual host that requires client certificates and give those hosts priority.
- Because IBM lists no workaround, plan the maintenance window instead of searching for a configuration change.
- Also review the other CVEs in the bulletin, since one fix covers them.
Why it matters
The record lists CWE-94 (improper control of code generation). IBM gives few technical details. It says the server is vulnerable to remote code execution and denial of service when it is set up for mutual TLS. The attack complexity is rated high, which usually means conditions beyond the attacker's control must line up.
Mutual TLS is often used for partner and machine interfaces, which makes it a good place to check first. Those hosts are reachable by many clients and deserve patch priority.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Try it yourself
One bulletin lists many CVEs and several products. A single view that groups them by what you actually run makes the work shorter.
Click through it at your own pace, or open it full screen.
Quick check
Is there a workaround?
IBM lists none. Apply the interim fix or the fix pack.
Does this affect only WebSphere?
It affects IBM HTTP Server, which is bundled with WebSphere Application Server and other IBM products. Check each product that bundles it.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
