What is the CVSS score of CVE-2026-11710?

CVE-2026-11710 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-11710?

Yes, a patch is available for CVE-2026-11710. Update the affected software to the latest version immediately.

WebSphere Application Server CVE-2026-11710

EUVD-2026-83287 MEDIUM

HTTP Request/Response Smuggling (CWE-444)

2026-09-18 ibm

GHSA-4vjg-vw7f-qrj3

Information Disclosure IBM Request Smuggling Websphere Application Server

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network, unauthenticated, but AC:H because smuggling needs a specific proxy parsing mismatch and iterative crafting; C:H for captured victim requests, I:L for limited request tampering, A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 18, 2026 - 20:05 vuln.today

DescriptionCVE.org

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers.

AnalysisAI

HTTP request smuggling in IBM WebSphere Application Server 8.5 can allow unauthenticated remote attackers to desynchronize request processing when the server sits behind or in front of an HTTP intermediary with mismatched Content-Length parsing, potentially leading to credential theft, cache poisoning, or request hijacking. The flaw (CWE-444) rates 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) and requires a specific proxy-layer mismatch and concurrent traffic; no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires WebSphere Application Server 8.5 to be deployed behind or in front of an HTTP intermediary (reverse proxy, load balancer, or CDN) whose Content-Length parsing differs from WebSphere's - request smuggling is inherently a two-party desync and cannot occur against a standalone server with no differing upstream/downstream parser. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Moderate, non-urgent priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	A patch is available per the IBM vendor advisory at https://www.ibm.com/support/pages/node/7286731; no exact fix version is provided in the input data, so consult the advisory for the specific patch level for WebSphere Application Server 8.5. … Detailed patch versions, workarounds, and compensating controls in full report.