What is the CVSS score of CVE-2026-15396?

CVE-2026-15396 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-15396?

Yes, a patch is available for CVE-2026-15396. Update the affected software to the latest version immediately.

IBM WebSphere Application Server CVE-2026-15396

EUVD-2026-78068 MEDIUM

HTTP Request/Response Smuggling (CWE-444)

2026-09-14 ibm

GHSA-2fc8-vf8h-jfvw

XSS IBM Request Smuggling Websphere Application Server

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

HTTP request smuggling requires a proxy-backend topology disagreement (AC:H); inter-user cache/XSS impact implies scope change (S:C); no authentication or UI needed to smuggle.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 07:44 vuln.today

CVE Published

Sep 14, 2026 - 20:08 nvd

MEDIUM 6.5

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

AnalysisAI

HTTP request smuggling in IBM WebSphere Application Server 8.5 and 9.0 (including the Liberty variant) enables unauthenticated remote attackers to manipulate shared HTTP caches, circumvent web application firewall rules, and inject malicious scripts into responses served to other users. The root cause is improper parsing of the HTTP Transfer-Encoding request header (CWE-444), a class of vulnerability that exploits disagreement between a front-end proxy and the back-end application server over where one HTTP request ends and the next begins. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Successful exploitation requires a reverse proxy or load balancer in front of WebSphere Application Server where the front-end and back-end parse the HTTP Transfer-Encoding header differently - exploitation against a WAS instance with no intermediary proxy is not viable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) merits scrutiny: the AC:L designation implies no special conditions, yet effective HTTP request smuggling requires a proxy-to-backend topology where the two tiers disagree on header parsing - not a universal deployment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the patch documented in IBM Security Bulletin https://www.ibm.com/support/pages/node/7286610; the advisory specifies the exact interim fix or cumulative fix package for WAS 8.5, WAS 9.0, and Liberty. … Detailed patch versions, workarounds, and compensating controls in full report.