CVE-2026-9072 is a high severity (CVSS 8.1) code injection flaw in the IBM WebSphere Web Server Plug-in used with Intelligent Management. An attacker who impersonates backend servers can send crafted responses. IBM says to apply the interim fix for APAR PH71376 or the listed fix pack.
What's affected
IBM's bulletin lists the Web Server Plug-ins for WebSphere Application Server and Liberty at 8.5 and 9.0, and IBM HTTP Server 9.0. For this CVE the condition is the use of Intelligent Management with the plug-in.
IBM's remediation for the plug-ins:
- V9.0.0.0 through 9.0.5.27: apply the plug-in interim fix for PH71376, or fix pack 9.0.5.28 or later
- V8.5.0.0 through 8.5.5.29: apply the interim fix for PH71376, or fix pack 8.5.5.30 or later
IBM lists no workarounds. The same bulletin includes two sibling CVEs for the plug-in, so the fix covers them too.
How to check if you're exposed
Find the plug-in version on each web server host. IBM ships a version information tool for the plug-in, and the plug-in installation directory also holds a version file. Then check for Intelligent Management use in your WebSphere cell configuration. If your plug-in configuration file lists dynamic clusters or on demand routing, you are in the described setup.
Next, review the network between the web servers and the application servers. The record says the attacker pretends to be a backend server, so any path where someone can impersonate a backend, such as a shared segment without TLS, raises the exposure.
What to do now
- Read the IBM bulletin and APAR PH71376.
- Apply the plug-in interim fix, or move to fix pack 9.0.5.28 or 8.5.5.30 or later.
- Use TLS between the plug-in and backend servers, and verify certificates.
- Place the web server tier and application tier on a segment that others cannot join.
- Check for the two sibling plug-in CVEs in the same bulletin and confirm the fix covers them.
Why it matters
The weakness is CWE-94 (improper control of generation of code). The plug-in runs inside the web server and parses responses from the servers behind it. If it trusts a response too much, a forged one can lead to code running in the web server process. IBM says the outcome can be remote code execution or denial of service.
The attack complexity is high because the attacker needs to be in a position to impersonate a backend. Network design and mutual authentication reduce that chance.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Does this affect Liberty as well?
The bulletin names WebSphere Application Server and Liberty when used with the Web Server Plug-in and Intelligent Management.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
