What is the CVSS score of CVE-2026-15634?

CVE-2026-15634 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-15634?

Yes, a patch is available for CVE-2026-15634. Update the affected software to the latest version immediately.

WebSphere Application Server CVE-2026-15634

EUVD-2026-78060 MEDIUM

HTTP Request/Response Smuggling (CWE-444)

2026-09-14 ibm

GHSA-mq4f-p367-w4xc

XSS IBM Request Smuggling Websphere Application Server

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

HTTP request smuggling requires a specific frontend-proxy-plus-backend topology to be exploitable, raising AC to High; no authentication or user interaction is required of the attacker.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 07:44 vuln.today

CVE Published

Sep 14, 2026 - 20:01 nvd

MEDIUM 6.5

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

AnalysisAI

HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty allows remote unauthenticated attackers to poison web caches, bypass web application firewall protections, and conduct cross-site scripting attacks by sending specially crafted Transfer-Encoding headers. The root cause is CWE-444, inconsistent interpretation of HTTP request boundaries between WebSphere and a frontend proxy component. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the ability to send HTTP requests with crafted Transfer-Encoding headers to a WebSphere Application Server instance, with no authentication required per the CVSS PR:N metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The IBM-supplied CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N rates this at 6.5, reflecting a network-accessible, unauthenticated attack with moderate confidentiality and integrity impact and no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the vendor-released patch from IBM's advisory at https://www.ibm.com/support/pages/node/7286610, which addresses the improper Transfer-Encoding header parsing in WebSphere Application Server 8.5, 9.0, and Liberty; consult that advisory for the exact fixed interim fix or fix pack version. … Detailed patch versions, workarounds, and compensating controls in full report.