CVE-2026-8855 affects IBM HTTP Server versions 8.5.0 and 9.0 and involves improper control over code generation (CWE-94). This vulnerability allows an attacker to execute arbitrary code remotely or cause a denial of service, specifically in configurations where TLS mutual authentication (client authentication) is enabled. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but lacks an official remediation or patch as of the published date.

Successful exploitation can result in remote code execution and denial of service on affected IBM HTTP Server instances configured with TLS mutual authentication. This can lead to full compromise of the server and disruption of service. The vulnerability is rated high severity (CVSS 8.1). There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider disabling TLS mutual authentication if feasible or applying compensating controls to limit exposure. Monitor IBM advisories for updates on patches or official mitigations.