Skip to content
Fencer Vulns
high 8.1

CVE-2026-8400 json

Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU

published 2026-08-05 3 mo ago modified 2026-08-10 2 mo ago also EUVD-2026-53438

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.

Patch / fix

  • java-1.8.0-ibm RHEL 8 1:1.8.0.8.70-1.el8_10
  • java-1.8.0-ibm-src RHEL 8 1:1.8.0.8.70-1.el8_10
  • java-1.8.0-ibm-demo RHEL 8 1:1.8.0.8.70-1.el8_10
  • java-1.8.0-ibm-jdbc RHEL 8 1:1.8.0.8.70-1.el8_10
  • java-1.8.0-ibm-plugin RHEL 8 1:1.8.0.8.70-1.el8_10
  • java-1.8.0-ibm-headless RHEL 8 1:1.8.0.8.70-1.el8_10
  • java-1.8.0-ibm-webstart RHEL 8 1:1.8.0.8.70-1.el8_10

red hat advisories RHSA-2026:52949

  • java-1_8_0-ibm SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +6 more 1.8.0_sr8.71-150000.3.125.1
  • java-1_8_0-ibm SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +6 more 1.8.0_sr8.70-150000.3.119.1
  • java-1_8_0-ibm SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.8.0_sr8.71-30.156.1
  • java-1_8_0-ibm SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.8.0_sr8.70-30.153.1

suse advisories SUSE-SU-2026:4153-1SUSE-SU-2026:4107-1SUSE-SU-2026:3615-1SUSE-SU-2026:3614-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-8400 updated cvss 8.1

java-1.8.0-ibm: Arbitrary class loading and instantiation via malicious IIOP server

  • Red Hat Enterprise Linux Supplementary (v. 8) java-1.8.0-ibm 1.8.0.8.70-1.el8_10, java-1.8.0-ibm-src 1.8.0.8.70-1.el8_10, java-1.8.0-ibm-demo 1.8.0.8.70-1.el8_10, java-1.8.0-ibm-jdbc 1.8.0.8.70-1.el8_10, java-1.8.0-ibm-plugin 1.8.0.8.70-1.el8_10, java-1.8.0-ibm-headless 1.8.0.8.70-1.el8_10, +1 more
    fixed: vendor fix “To mitigate this issue, ensure that applications are configured to only connect to trusted IIOP servers. Restrict network access to prevent connections to untrusted or external IIOP endpoints.” RHSA-2026:52949

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • IBM WebSphere Application Server
  • IBM WebSphere Application Server - Liberty

Classification

Weakness
  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.