What is the CVSS score of CVE-2026-11541?

CVE-2026-11541 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere are affected by CVE-2026-11541?

IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Liberty (versions 17.0.0.3 through 26.0.0.6) contain a critical HTTP request smuggling vulnerability (CVE-2026-11541, CVSS 9.8)…. A patch is available.

How to fix or mitigate CVE-2026-11541?

Within 24 hours: Conduct inventory of all IBM WebSphere Application Server (8.5, 9.0) and WebSphere Liberty (17.0.0.3-26.0.0.6) deployments; identify which sit behind proxy/load balancer infrastructure. Within 7 days: Obtain patched versions from IBM security advisory; develop and test deployment plan for each environment. Within 30 days: Deploy patched versions to all affected WebSphere instances and confirm patch application.

IBM WebSphere CVE-2026-11541

EUVD-2026-40413 CRITICAL

HTTP Request/Response Smuggling (CWE-444)

2026-06-30 ibm

GHSA-974x-wv37-rccw

Request Smuggling IBM Information Disclosure Websphere Application Server Websphere Application Server Liberty

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.9 HIGH

Network, unauthenticated, no user interaction, but a divergent front-end/back-end proxy pairing is needed (AC:H); smuggling yields high confidentiality and integrity impact with no direct availability effect (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:13 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:07 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 18:07 NVD

HIGH CRITICAL

CVSS changed

Jul 02, 2026 - 18:07 NVD

7.4 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jun 30, 2026 - 22:00 vuln.today

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.

AnalysisAI

HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 through 26.0.0.6) lets remote attackers desynchronize how front-end proxies and the WebSphere back-end parse HTTP request boundaries, enabling request-queue poisoning, security-control bypass, and disclosure of other users' data (tagged Information Disclosure). The CVSS 9.8 vector rates all impacts high, but SSVC records no observed exploitation and EPSS is low (0.34%); no public exploit is identified at time of analysis, and a vendor patch is available. Realistic exploitation depends on WebSphere sitting behind an intermediary that disagrees with it on request framing.

Technical ContextAI

The affected technology is IBM's Java/Jakarta EE application server in two forms - the traditional WebSphere Application Server (WAS 8.5, 9.0) and the lightweight WebSphere Liberty runtime (17.0.0.3 through 26.0.0.6), matching CPEs cpe:2.3:a:ibm:websphere_application_server and cpe:2.3:a:ibm:websphere_application_server_-_liberty. The root cause is CWE-444, Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'): when two HTTP agents in a chain (typically a reverse proxy, load balancer, or CDN in front of WebSphere) disagree on where one request ends and the next begins - usually through conflicting Content-Length and Transfer-Encoding handling or malformed chunked encoding - an attacker can smuggle a second request past the front-end that the back-end treats as belonging to another connection or user. This is a parsing/boundary defect in the HTTP transport layer rather than in application code, so it can affect any application hosted on the vulnerable server.

RemediationAI

Patch available per IBM advisory (https://www.ibm.com/support/pages/node/7277550): apply the IBM-provided interim fix/iFix or fix pack for your specific WebSphere edition and release - for traditional WAS 8.5 and 9.0 install the recommended APAR/iFix, and for Liberty upgrade to the fixed release above 26.0.0.6 as directed by IBM (the exact fix version is specified on the IBM support node and is not reproduced here to avoid inventing a number). If immediate patching is not possible, reduce exposure at the intermediary layer: configure the front-end proxy, load balancer, or CDN to reject ambiguous requests containing both Content-Length and Transfer-Encoding headers, normalize or strip Transfer-Encoding, and drop malformed chunked-encoding requests - the trade-off is that some legitimate but non-conformant clients may be rejected. Ensure the proxy and WebSphere agree on HTTP framing (prefer HTTP/2 to the back-end or strict HTTP/1.1 conformance where supported), and restrict direct network access to the WebSphere HTTP ports so requests cannot bypass the hardened intermediary; the side effects are added latency, configuration complexity, and potential breakage of legacy integrations.