CVE-2026-9072 affects IBM i versions 7.3.0, 7.4.0, 7.5.0, and 7.6.0, as well as IBM WebSphere Application Server and Liberty when using Intelligent Management with the WebSphere WebServer Plug-in. The vulnerability allows remote attackers to execute arbitrary code or cause denial of service by impersonating backend servers and sending crafted responses to the plug-in component. This is a code injection vulnerability categorized under CWE-94. The CVSS 3.1 score of 8.1 indicates a high-severity issue exploitable over the network without privileges or user interaction but requiring high attack complexity. The vendor has not yet provided an official fix or remediation guidance, and no exploits have been observed in the wild to date.

Successful exploitation of this vulnerability can lead to remote code execution and denial of service on affected IBM i systems and WebSphere Application Server environments using the specified plug-in. This compromises confidentiality, integrity, and availability of the affected systems. The attack requires impersonation of backend servers and sending crafted responses, which may involve complex attack conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor IBM security advisories for updates. Given the high attack complexity and requirement to impersonate backend servers, network segmentation and strict validation of backend server communications may reduce risk but are not confirmed mitigations by the vendor.