Armonk, 28 May 2026
IBM has disclosed a high-severity vulnerability in its HTTP Server, while a separate critical flaw in the widely used 7-Zip archiver enables remote code execution through maliciously crafted archives.
The vulnerability in IBM HTTP Server, tracked as CVE-2026-48095, carries a CVSS score of 8.8 and could allow attackers to cause a denial-of-service condition or potentially execute arbitrary code. The flaw was disclosed as part of a routine security bulletin, though one source described it as a "forgotten" vulnerability entry rather than an emergency fix.
In a related advisory, Microsoft addressed a similarly rated vulnerability in SharePoint Server. Authenticated attackers on the network can inject code through CVE-2026-45659, which also holds a CVSS score of 8.8 and is classified as high risk.
SharePoint Code Injection Risk
The SharePoint update is available for SharePoint Server 2016, SharePoint Enterprise Server 2016, SharePoint Server 2019, and the Subscription Edition. Administrators are advised to apply the patches as part of their regular update cycles.
Meanwhile, a dangerous flaw in the popular file compression tool 7-Zip has been patched. The vulnerability allows attackers to craft archive files that, when opened by a user, can execute malicious code on the victim's system.
According to the report, the root cause is a heap buffer overflow triggered by insufficient allocation in the NTFS compression stream buffer. The flaw affects common archive formats including .7z, .zip, and .rar.
7-Zip Exploit Mechanics
On 64-bit systems, the exploit is reportedly only reliable when at least 16 GB of RAM is installed. However, simply opening a malicious archive with 7-Zip is enough to trigger the attack, making it a significant threat to unsuspecting users.
The 7-Zip vulnerability was patched in a release issued on May 27. Users should update to the latest version immediately to mitigate the risk.
Security researchers have warned that both vulnerabilities could be exploited in targeted attacks, particularly against enterprise environments where IBM HTTP Server and SharePoint are commonly deployed. No active exploits have been confirmed in the wild at the time of disclosure.
Mitigation and Patching Guidance
Organizations are advised to review their asset inventories for affected software versions and prioritize patching based on exposure. For 7-Zip, individual users should enable automatic updates or manually download the latest version from the official website.
The coordinated disclosure highlights the ongoing challenge of securing widely deployed enterprise and consumer software against memory corruption flaws. Both IBM and Microsoft have credited external researchers for reporting the issues through responsible disclosure channels.