CVE-2026-15634: IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
Published Sep 14, 2026
·Updated
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
Affected Software
1 affected componentFixes available
IBM CICS TX Advanced<=10.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server traditional (v8.5.0.0 through 8.5.5.30)to a version that resolves this vulnerability.Fixed in 8.5.5.31 - Upgrade
Upgrade
IBM WebSphere Application Server traditional (v9.0.0.0 through 9.0.5.28)to a version that resolves this vulnerability.Fixed in 9.0.5.29Patch SB0030823
Event History
Sep 14, 2026
CVE Published
via MITRE·08:01 PM
Data Sourced
via MITRE·08:01 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeakness
Sep 16, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software