Description
IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
Published: 2026-06-30
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM CICS Transaction Gateway for Multiplatforms versions 9.1.0.0, 9.2.0.0, 9.3.0.0, and 10.1.0.0, as well as IBM WebSphere Application Server 8.5, 9.0 and Liberty 17.0.0.3 through 26.0.0.6, contain an HTTP request smuggling flaw that can let attackers manipulate HTTP request parsing, potentially leading to tampering of request data and compromising application integrity. This weakness corresponds to CWE‑444 and may allow an attacker to alter or discard parts of a request or response.

Affected Systems

The affected servers include IBM CICS Transaction Gateway for Multiplatforms 9.1.0.0, 9.2.0.0, 9.3.0.0, and 10.1.0.0, as well as IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server – Liberty 17.0.0.3 through 26.0.0.6.

Risk and Exploitability

The CVSS score of 7.4 indicates high severity, with an EPSS score of less than 1% and no KEV listing. Based on the description, the likely remote attack vector is an attacker sending crafted HTTP traffic to a vulnerable CICS Transaction Gateway for Multiplatforms or WebSphere Application Server instance. Successful exploitation could allow tampering of request handling, leading to unauthorized data access or service disruption.

Generated by OpenCVE AI on August 4, 2026 at 08:12 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by downloading and applying the CICS Transaction Gateway for Multiplatforms fixes. Product VRMF APAR Remediation/First Fix CICS Transaction Gateway for Multiplatforms9.1.0.0 - PSIRT fixes for CICS Transaction Gateway for Multiplatforms will be provided only to customers covered by Extended Support and only upon request through an IBM Support case. CICS Transaction Gateway for Multiplatforms9.2.0.0 PH72094 AIX Link https://www.ibm.com/support/fixcentral/quickorder pLinux Big Endian Link https://www.ibm.com/support/fixcentral/quickorder Windows Link https://www.ibm.com/support/fixcentral/quickorder iLinux Link https://www.ibm.com/support/fixcentral/quickorder zLinux Link https://www.ibm.com/support/fixcentral/quickorder CICS Transaction Gateway for Multiplatforms9.3.0.0 PH72094 AIX Link https://www.ibm.com/support/fixcentral/quickorder pLinux Little Endian Link https://www.ibm.com/support/fixcentral/quickorder pLinux Big Endian Link https://www.ibm.com/support/fixcentral/quickorder Windows Link https://www.ibm.com/support/fixcentral/quickorder iLinux Link https://www.ibm.com/support/fixcentral/quickorder zLinux Link https://www.ibm.com/support/fixcentral/quickorder x86 Container Link https://www.ibm.com/support/fixcentral/quickorder 390x Container Link https://www.ibm.com/support/fixcentral/quickorder CICS Transaction Gateway for Multiplatforms10.1.0.0 PH72095 AIX Link https://www.ibm.com/support/fixcentral/quickorder pLinux Little Endian Link https://www.ibm.com/support/fixcentral/quickorder Windows Link https://www.ibm.com/support/fixcentral/quickorder iLinux Link https://www.ibm.com/support/fixcentral/quickorder zLinux Link https://www.ibm.com/support/fixcentral/quickorder x86 Container Link https://www.ibm.com/support/fixcentral/quickorder 390x Container Link https://www.ibm.com/support/fixcentral/quickorder

OpenCVE Recommended Actions

  • Identify the installed CICS Transaction Gateway for Multiplatforms version and download the corresponding IBM Fix Central update: PH72094 for versions 9.2.0.0 and 9.3.0.0, or PH72095 for 10.1.0.0, and apply the patch.
  • If the instance runs version 9.1.0.0, submit an IBM Support case to request a fix under Extended Support; apply the patch when released.
  • While awaiting a fix, enforce strict HTTP request parsing policies on inbound traffic to reduce the risk of exploitation.

Generated by OpenCVE AI on August 4, 2026 at 08:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability. IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
Title IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.
CPEs cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.6:*:*:*:*:*:*:*
References

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 30 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
Title IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling
First Time appeared Ibm
Ibm websphere Application Server
Ibm websphere Application Server Liberty
Weaknesses CWE-444
CPEs cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.6:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm websphere Application Server
Ibm websphere Application Server Liberty
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Ibm Websphere Application Server Websphere Application Server Liberty
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-29T18:12:49.178Z

Reserved: 2026-06-08T02:55:08.653Z

Link: CVE-2026-11541

cve-icon Vulnrichment

Updated: 2026-07-01T14:52:11.835Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T08:15:06Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')