[UPDATE] [high] IBM HTTP Server: Multiple Vulnerabilities

highCVE-2026-45186 CVE-2026-8834 CVE-2026-8835 CVE-2026-8850 CVE-2026-8852 CVE-2026-8854

An attacker can exploit multiple vulnerabilities in IBM HTTP Server to execute arbitrary program code and to conduct a denial of service attack.

CSIRTS triage

vendor: IBM product: IBM HTTP Server Remote code execution Denial of service

What: Multiple vulnerabilities allow an attacker to execute arbitrary program code and conduct denial of service attacks.
Who is affected: Deployments of IBM HTTP Server are affected by these vulnerabilities.
Urgency: Remediation is high urgency due to the severity of the vulnerabilities and potential for exploitation.
Action: Apply the latest patches for IBM HTTP Server to address these vulnerabilities.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch IBM HTTP Server

Get an email when a new IBM HTTP Server advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-07-23
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1685

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-451860.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all scored CVEs.
Low exploitation riskCVE-2026-88340.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all scored CVEs.
Low exploitation riskCVE-2026-88350.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
Low exploitation riskCVE-2026-88500.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.
Low exploitation riskCVE-2026-88520.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all scored CVEs.
Low exploitation riskCVE-2026-88540.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.
Low exploitation riskCVE-2026-88550.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all scored CVEs.
Low exploitation riskCVE-2026-88560.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all scored CVEs.
Low exploitation riskCVE-2026-91700.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-45186	coverage & exploitation status	NVD · CVE.org
CVE-2026-8834	coverage & exploitation status	NVD · CVE.org
CVE-2026-8835	coverage & exploitation status	NVD · CVE.org
CVE-2026-8850	coverage & exploitation status	NVD · CVE.org
CVE-2026-8852	coverage & exploitation status	NVD · CVE.org
CVE-2026-8854	coverage & exploitation status	NVD · CVE.org
CVE-2026-8855	coverage & exploitation status	NVD · CVE.org
CVE-2026-8856	coverage & exploitation status	NVD · CVE.org
CVE-2026-9170	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownDSA-6404-1 expat - security updatedebian
low[UPDATE] [low] expat: Vulnerability allows Denial of Servicecert-bund

Recent advisories for IBM HTTP Server

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-9322: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17…nvd · 2026-07-30
highCVE-2026-15328: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 1…nvd · 2026-07-28
highCVE-2026-15325: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 1…nvd · 2026-07-28
highCVE-2026-15064: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 1…nvd · 2026-07-28
highCVE-2026-14981: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 1…nvd · 2026-07-28
highCVE-2026-11541: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 1…nvd · 2026-06-30