CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

IBM HTTP Server / WebSphere Application Server, pre-auth RCE via improper input validation in HTTP request parser (CVSS 9.8); NCSC.ch flagged 2026-05-28

cve · CVE-2026-9170

Coverage
1
first 2026-05-29 → last 2026-09-30
Latest activity
2026-05-29
IBM HTTP Server's CVSS 9.8 flaw CVE-2026-9170 is fixed in Fix Packs 9.0.5.29 and 8.5.5.30, both now released
Peak priority
notable
1 notable
Targets
·
regions: europe, switzerland
Sources cited
5
3 hosts

Defender insights

What each entry about CVE-2026-9170 tells a defender to do, newest first.

2026-05-29NOTABLEIBM HTTP Server's CVSS 9.8 flaw CVE-2026-9170 is fixed in Fix Packs 9.0.5.29 and 8.5.5.30, both now released

Exposure

Story timeline

  1. 2026-05-29CVE-2026-9170: IBM HTTP Server improper input validation allows denial of service and potential remote code execution without authentication (CVSS 9.8)
    trending-vulnerabilitiesIBM HTTP Server's CVSS 9.8 flaw CVE-2026-9170 is fixed in Fix Packs 9.0.5.29 and 8.5.5.30, both now released

Hunting pivots

Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-29/cve-2026-9170-ibm-http-server-websphere-application-server-p · ATT&CK page ↗

Entries about IBM HTTP Server / WebSphere Application Server, pre-auth RCE via improper input validation in HTTP request parser (CVSS 9.8); NCSC.ch flagged 2026-05-28 (1)

2026-05-29 · view entry permalink →

NOTABLECVE-2026-9170updatedNATOA2

CVE-2026-9170: IBM HTTP Server improper input validation allows denial of service and potential remote code execution without authentication (CVSS 9.8)

IBM's bulletin of 2026-05-26 fixes nine vulnerabilities in IBM HTTP Server (IHS), the Apache-based component shipped with all editions of WebSphere Application Server and bundling products. The most severe, CVE-2026-9170, is improper input validation (CWE-94) that IBM says makes IHS "vulnerable to denial of service and a potential remote code execution", scored CVSS 9.8 by IBM with a network attack vector and no privileges or user interaction required (IBM, 2026-05-26). The other flaws include CVE-2026-8855 (CVSS 8.1), remote code execution in configurations with TLS client authentication, and CVE-2026-8834 (CVSS 8.0), a heap overflow reachable by a privileged user authenticated to the Administration Server (IBM, 2026-05-26). NCSC-CH flagged the advisory on 2026-05-28 and gives the exploitation status as unknown (NCSC-CH Cyber Security Hub, 2026-05-28). CVE-2026-9170 is not in CISA's KEV catalog as of 2026-09-29 (CISA KEV catalog, 2026-09-29).

CVE-2026-9170 CVSS3.1: 9.8 (CRITICAL) - Improper input validation leading to RCE and DoS

NCSC.ch Security Hub post 12601

IBM HTTP Server is vulnerable to denial of service and a potential remote code execution due to improper input validation.

IBM Security Bulletin
Correctionrun 2026-09-30T0639Z-auditbodyclassificationtechniquestitleheadlinesummaryprioritysectorscvesevidencesources

The earlier text placed the flaw in the HTTP request-parsing layer behind the default web listener, which IBM's bulletin does not say, said fix packs were already out when only an interim fix existed, and attributed module-disabling advice to IBM. IBM describes CVE-2026-9170 as improper input validation that can cause denial of service and potential remote code execution, scores it CVSS 9.8 itself with a network attack vector and no privileges or user interaction, offered an interim fix for APAR PH71265 with fix packs targeted for 3Q2026, and lists no workaround (IBM, 2026-05-26). Fix Pack 8.5.5.30 was released on 2026-07-27 and 9.0.5.29 on 2026-09-08 (IBM, 2026-09-08). The module advice comes from NCSC-CH and covers certain denial-of-service vectors only, and NCSC-CH gives the exploitation status as unknown rather than none observed (NCSC-CH Cyber Security Hub, 2026-05-28). No cited source describes where the product is deployed, so an earlier claim about Swiss banking, insurance and federal estates is withdrawn.

vulnerability29 May 05:00Zmulti-sourceOpen finding →
Sources: IBM Security Bulletin node/7274065 · NCSC.ch Security Hub post 12601 · CISA KEV catalog · IBM, Recommended updates for WebSphere Application Server · IBM, IBM HTTP Server latest cumulative security interim fix

explore in graph

Where this entity is cited

  • Vulns1

Source distribution

  • ibm.com3 (60%)
  • cisa.gov1 (20%)
  • security-hub.ncsc.admin.ch1 (20%)

External references

NVD · cve.org · CISA KEV

All cited sources (5)