IBM WebSphere Application Server CVE-2026-15396

Successful exploitation requires a reverse proxy or load balancer in front of WebSphere Application Server where the front-end and back-end parse the HTTP Transfer-Encoding header differently - exploitation against a WAS instance with no intermediary proxy is not viable. The attacker requires no authentication (PR:N per CVSS) and no victim interaction for the smuggling step itself; however, realising the XSS impact requires a subsequent victim to browse to the cache-poisoned resource (UI:R for that secondary impact chain). Exploitation is further limited to HTTP/1.1 request paths; HTTP/2-only configurations are generally not directly susceptible to classic Transfer-Encoding smuggling. Both the full WAS profile and the Liberty profile are affected, including containerized Liberty deployments behind a proxy.

The vendor-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) merits scrutiny: the AC:L designation implies no special conditions, yet effective HTTP request smuggling requires a proxy-to-backend topology where the two tiers disagree on header parsing - not a universal deployment. In typical standalone WAS deployments without an intervening reverse proxy, this attack path collapses. Real-world risk is thus deployment-topology-dependent and practically AC:H. The scope metric S:U also understates the inter-user impact: cache poisoning and XSS inherently affect other users' sessions, suggesting S:C is more accurate. EPSS data is not provided, and the vulnerability is absent from the CISA KEV catalog, consistent with no confirmed active exploitation. No public proof-of-concept has been identified. The combination of no KEV, no POC, and a topology prerequisite places this in a realistic medium-priority tier - even a mid-sized municipal IT team in gniezno should treat this as important hygiene work but not an emergency zero-day response. The XSS vector adds credential-theft potential where victim interaction occurs, slightly elevating integrity and confidentiality concerns beyond what the raw CVSS score conveys.

An attacker sends a specially crafted HTTP request containing a malformed or obfuscated Transfer-Encoding header to a deployment where a reverse proxy sits in front of WebSphere Application Server. The proxy forwards the request, but WAS parses the body boundary differently, causing it to treat a fragment of the attacker's payload as the start of the next request from a legitimate user. The attacker exploits this desynchronisation to poison a shared cache with a response containing a malicious JavaScript payload, which is subsequently served to an unsuspecting user visiting a legitimate page, resulting in session token exfiltration.