Description
IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling.
Published: 2026-09-18
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: HTTP request smuggling vulnerability
Action: Patch Immediately
AI Analysis

Impact

IBM WebSphere Application Server 8.5, 9.0, and Liberty contain an HTTP request smuggling flaw that allows a sender to manipulate the processing of HTTP requests. This weakness can lead to unexpected request handling, potentially exposing data or causing resource misuse. The flaw is catalogued as CWE-444: HTTP Request Smuggling.

Affected Systems

The vulnerability affects IBM CICS TX Advanced 10.1 on Linux as well as IBM WebSphere Application Server 8.5, 9.0, and Liberty products that ship with this component. No other product versions are listed in the CNA data.

Risk and Exploitability

The CVSS score of 4.8 indicates a low impact, while the EPSS score is 0.00177 (i.e., < 1%) and the vulnerability is not listed in CISA KEV, suggesting a very low but non-zero exploitation likelihood. The likely attack vector is remote HTTP traffic; an attacker would need to craft specially formatted requests to exploit the flaw. Given the low severity and lack of widespread exploitation data, operators should treat this as a low-risk issue that merits timely remediation.

Generated by OpenCVE AI on October 1, 2026 at 22:33 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by downloading and applying the below fix. ProductVersionPlatformRemediation/FixIBM CICS TX Advanced10.1Linux Download and apply the update from  Fix Central https://www.ibm.com/support/fixcentral/quickorder

OpenCVE Recommended Actions

  • Download and apply the IBM CICS TX Advanced 10.1 Linux update from Fix Central.
  • Restart the IBM CICS TX Advanced service so the new binaries and configuration take effect.
  • Configure IBM WebSphere to enforce strict HTTP request validation and disable any ambiguous request processing options to reduce the attack surface.

Generated by OpenCVE AI on October 1, 2026 at 22:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

 cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 18 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling.
Title Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.
First Time appeared Ibm
Ibm cics Tx Advanced
Weaknesses CWE-444
CPEs cpe:2.3:a:ibm:cics_tx_advanced:10.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cics_tx_advanced:10.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm cics Tx Advanced
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Ibm Cics Tx Advanced
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-30T17:25:55.058Z

Reserved: 2026-06-04T11:45:44.144Z

Link: CVE-2026-10841

cve-icon Vulnrichment

Updated: 2026-09-18T17:24:46.658Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-09-18T16:17:05.027

Modified: 2026-09-30T18:18:18.233

Link: CVE-2026-10841

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T22:45:13Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')