CVE-2026-9170: IBM HTTP Server RCE Vulnerability

CVE-2026-9170 Overview

CVE-2026-9170 affects IBM HTTP Server versions 8.5 and 9.0. The vulnerability is classified under [CWE-94] (Improper Control of Generation of Code), indicating a code injection weakness. Remote attackers can exploit this flaw over the network without authentication or user interaction.

The vulnerability impacts confidentiality, integrity, and availability of the affected web server. IBM HTTP Server is widely deployed as a front-end web server in enterprise environments, often hosting WebSphere Application Server workloads.

Critical Impact

Unauthenticated attackers can inject and execute code on vulnerable IBM HTTP Server 8.5 and 9.0 instances, leading to full compromise of the web server.

Affected Products

• IBM HTTP Server 8.5
• IBM HTTP Server 9.0
• Deployments using cpe:2.3:a:ibm:http_server:8.5.0.0 and cpe:2.3:a:ibm:http_server:9.0.0.0

Discovery Timeline

• 2026-05-26 - CVE-2026-9170 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-9170

Vulnerability Analysis

CVE-2026-9170 is a code injection vulnerability in IBM HTTP Server 8.5 and 9.0. The flaw allows an attacker to influence how the server generates or evaluates code, enabling execution of attacker-controlled instructions within the server process.

The attack vector is network-based and requires no privileges or user interaction. Successful exploitation grants the attacker the same level of access as the running web server process. This typically allows reading sensitive configuration, modifying served content, and pivoting deeper into the application stack.

IBM HTTP Server commonly fronts WebSphere Application Server deployments, which expands the blast radius. A compromised front-end can expose backend application traffic, session data, and credentials transiting the server.

Root Cause

The root cause is improper control over code generation, mapped to [CWE-94]. The server processes input that is later interpreted as code or directives without sufficient validation or sanitization. This permits crafted requests to alter the intended execution flow of the server.

Attack Vector

The attacker sends a crafted HTTP request to a reachable IBM HTTP Server instance. Because authentication is not required, any network-accessible deployment is exposed. Internet-facing servers carry the highest risk, but lateral movement scenarios make internal instances equally important to patch.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.049%, placing it in the 15.7 percentile for likelihood of exploitation in the near term.

Technical specifics of the injection mechanism are described in the IBM Support Page.

Detection Methods for CVE-2026-9170

Indicators of Compromise

• Unexpected child processes spawned by httpd or IBM HTTP Server worker processes.
• Outbound network connections from the web server to unfamiliar external hosts.
• Modifications to server configuration files, document roots, or module directories outside change-management windows.
• HTTP access logs containing unusually long, encoded, or structurally malformed request parameters targeting server-handled endpoints.

Detection Strategies

• Inventory all IBM HTTP Server instances and confirm version strings against 8.5.x and 9.0.x ranges.
• Apply web application firewall rules to flag and block requests carrying code-like payloads to HTTP Server endpoints.
• Correlate web server logs with endpoint process telemetry to identify post-exploitation activity such as shell spawns or credential access.

Monitoring Recommendations

• Enable verbose access and error logging on IBM HTTP Server and forward logs to a centralized SIEM for retention and analysis.
• Establish baselines for normal httpd process behavior and alert on deviations such as new listening ports or child processes.
• Monitor file integrity on conf/, modules/, and document root directories.

How to Mitigate CVE-2026-9170

Immediate Actions Required

• Identify all IBM HTTP Server 8.5 and 9.0 deployments across production, staging, and development environments.
• Apply the IBM security update referenced in the vendor advisory as soon as testing permits.
• Restrict network exposure of management interfaces and limit direct internet access where feasible.
• Review web server and downstream application logs for suspicious requests predating the patch.

Patch Information

IBM has published remediation guidance on the IBM Support Page. Administrators should consult the advisory for the specific fix pack or interim fix that corresponds to their installed version of IBM HTTP Server 8.5 or 9.0.

Workarounds

• Place IBM HTTP Server behind a hardened reverse proxy or web application firewall configured to filter code injection patterns.
• Disable any non-essential modules and handlers that process dynamic content to reduce the attack surface.
• Apply strict network segmentation so that the web server can only reach the backend services it requires.

# Verify IBM HTTP Server version on the host
<IHS_INSTALL_ROOT>/bin/versionInfo.sh

# Example: list loaded modules to identify unnecessary handlers
<IHS_INSTALL_ROOT>/bin/apachectl -M