What is the CVSS score of CVE-2026-15328?

CVE-2026-15328 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM WebSphere are affected by CVE-2026-15328?

IBM WebSphere Application Server (versions 8.5, 9.0, and Liberty 17.0.0.3-26.0.0.7) contains an HTTP request smuggling vulnerability that could allow attackers to poison connections between front-end…. A patch is available.

How to fix or mitigate CVE-2026-15328?

Within 24 hours, conduct an inventory of all IBM WebSphere Application Server instances across versions 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7, and identify which systems are deployed behind HTTP reverse proxies-prioritizing those handling authentication or sensitive transactions. Within 7 days, obtain the vendor-released patch from IBM, stage it in a test environment that mirrors your proxy configuration, and validate proper HTTP request routing behavior before production deployment. Within 30 days, deploy patches to all affected production systems, starting with highest-risk deployments, and confirm remediation through configuration review and regression testing with your proxy infrastructure team.

IBM WebSphere CVE-2026-15328

EUVD-2026-50020 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-07-28 ibm

GHSA-f3v3-mj3c-p68c

Information Disclosure IBM Request Smuggling Websphere Application Server Websphere Application Server Liberty

8.1

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network vector with no auth required (PR:N), but AC:H reflects mandatory proxy-parsing differential; full C/I/A impact from session poisoning is credible.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 15:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 15:37 vuln.today

cvss_changed

CVSS changed

Aug 05, 2026 - 15:37 NVD

7.4 (HIGH) 8.1 (HIGH)

Analysis Generated

Jul 28, 2026 - 21:00 vuln.today

CVE Published

Jul 28, 2026 - 20:04 cve.org

HIGH 7.4

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling.

AnalysisAI

HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) enables remote unauthenticated attackers to poison shared HTTP connections between a front-end proxy and the application server backend. The CVSS 8.1 score reflects full confidentiality, integrity, and availability impact (C:H/I:H/A:H) but is constrained by high attack complexity (AC:H), requiring a specific proxy-to-WAS pipeline configuration to exploit. No public exploit is identified at time of analysis; EPSS is very low at 0.21% (11th percentile) and SSVC confirms no known exploitation, though technical impact is rated total.

Technical ContextAI

CWE-444 - 'Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling)' - describes the root cause: when a front-end proxy or load balancer and a back-end application server disagree on where HTTP/1.1 request boundaries fall, typically through conflicting handling of Content-Length and Transfer-Encoding headers or HTTP/2-to-HTTP/1.1 downgrade paths. IBM WebSphere Application Server is a mature Java EE/Jakarta EE platform widely deployed in large enterprise environments, while the Liberty profile (cpe:2.3:a:ibm:websphere_application_server_-_liberty) is IBM's lightweight, modular variant designed for microservices and cloud workloads. Both share the HTTP parsing layer vulnerable to this class of attack. Affected CPEs are cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (versions 8.5, 9.0) and cpe:2.3:a:ibm:websphere_application_server_-_liberty:*:*:*:*:*:*:*:* (17.0.0.3 through 26.0.0.7).

RemediationAI

The primary fix is the vendor-released patch documented in IBM's advisory at https://www.ibm.com/support/pages/node/7281625; administrators should consult this page directly for the exact iFix or Fix Pack version applicable to their WebSphere or Liberty release, as the specific fix version is not independently confirmed from available data. As compensating controls while patch deployment is assessed: restrict WebSphere and Liberty instances to accept inbound HTTP connections only from explicitly trusted, internally controlled reverse proxies rather than direct public internet exposure - this significantly raises the bar for the AC:H exploitation path without eliminating it. Where the proxy layer permits, disable or restrict HTTP/1.1 keep-alive connections or enforce strict Transfer-Encoding header handling at the proxy, though this may degrade throughput for high-volume workloads. Network segmentation placing WebSphere behind internal trust boundaries materially reduces exploitability given that the smuggling chain requires a specific proxy-to-backend pipeline.