Description
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.
Published: 2026-09-18
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: HTTP Request Smuggling
Action: Apply Patch
AI Analysis

Impact

IBM WebSphere Application Server Liberty, shipped with IBM CICS TX Advanced, contains an HTTP request smuggling vulnerability. Crafted HTTP requests can bypass the server's normal request parsing logic, allowing an attacker to insert or forge additional request data. This manipulation can lead to unauthorized data visibility, alteration of application behavior, or service disruption, and may serve as a foothold for more serious exploitation depending on the application context.

Affected Systems

The affected product is IBM CICS TX Advanced, version 10.1 on Linux. The vulnerability is present in the WebSphere Application Server Liberty component bundled with this product.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, implying no widely known exploitation at present. The likely attack vector is over the network via HTTP traffic to the affected Liberty application server, requiring an external actor to send specially crafted requests.

Generated by OpenCVE AI on September 19, 2026 at 10:48 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by downloading and applying the below fix. ProductVersionPlatformRemediation/FixIBM CICS TX Advanced10.1Linux Download and apply the update from  Fix Central https://www.ibm.com/support/fixcentral/quickorder

OpenCVE Recommended Actions

  • Download and install the IBM CICS TX Advanced 10.1 Linux update from IBM Fix Central (https://www.ibm.com/support/fixcentral/quickorder).
  • Apply the update following IBM's instructions to remediate the HTTP request smuggling vulnerability.
  • If an immediate update is not possible, restrict or filter inbound HTTP traffic to the server to mitigate request smuggling attempts until a patch is applied.

Generated by OpenCVE AI on September 19, 2026 at 10:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 19 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.
Title Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.
First Time appeared Ibm
Ibm cics Tx Advanced
Weaknesses CWE-444
CPEs cpe:2.3:a:ibm:cics_tx_advanced:10.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cics_tx_advanced:10.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm cics Tx Advanced
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Ibm Cics Tx Advanced
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-19T14:11:41.963Z

Reserved: 2026-06-09T02:07:36.508Z

Link: CVE-2026-11722

cve-icon Vulnrichment

Updated: 2026-09-19T14:08:35.962Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-18T20:17:03.020

Modified: 2026-09-22T19:32:25.730

Link: CVE-2026-11722

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T03:45:12Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')