What is the CVSS score of CVE-2026-8646?

CVE-2026-8646 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of IBM WebSphere are affected by CVE-2026-8646?

IBM WebSphere Application Server contains a critical authentication bypass vulnerability affecting both traditional and Liberty deployments that could allow attackers to assume user identities and…. A patch is available.

How to fix or mitigate CVE-2026-8646?

Within 24 hours: Inventory all systems running IBM WebSphere Application Server 8.5, 9.0, or Liberty versions 17.0.0.3 through 26.0.0.6 and restrict network access to affected instances. Within 7 days: Deploy IBM's released patch to all affected systems, prioritizing production environments. Within 30 days: Complete patching across all systems and validate patch effectiveness through security testing.

IBM WebSphere CVE-2026-8646

EUVD-2026-38251 CRITICAL

HTTP Request/Response Smuggling (CWE-444)

2026-06-22 ibm

GHSA-gmfx-j9mc-3x8v

IBM Request Smuggling Information Disclosure Websphere Application Server Websphere Application Server Liberty

9.1

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.7 CRITICAL

Network-reachable and unauthenticated, but AC:H because exploitation depends on a desynchronizing upstream proxy; scope changes to affect other users' sessions, with high C/I and no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 23, 2026 - 20:59 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 23, 2026 - 20:59 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 23, 2026 - 20:52 vuln.today

cvss_changed

Severity Changed

Jun 23, 2026 - 20:52 NVD

HIGH CRITICAL

CVSS changed

Jun 23, 2026 - 20:52 NVD

7.4 (HIGH) 9.1 (CRITICAL)

Analysis Generated

Jun 22, 2026 - 16:03 vuln.today

DescriptionNVD

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.

AnalysisAI

HTTP request smuggling in IBM WebSphere Application Server 8.5/9.0 and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6 allows unauthenticated remote attackers to bypass security controls, spoof identities, escalate privileges, and access sensitive information. IBM has released fixes and SSVC currently rates exploitation as 'none' with EPSS at 0.35% (27th percentile), but the CVSS 9.1 rating and total technical impact warrant prompt patching given the product's enterprise footprint. No public exploit identified at time of analysis.

Technical ContextAI

WebSphere Application Server is IBM's flagship Java EE/Jakarta EE application server, with the Liberty profile being a lightweight, modular variant widely used to host enterprise Java workloads and microservices. CWE-444 (Inconsistent Interpretation of HTTP Requests, a.k.a. HTTP Request Smuggling) arises when front-end and back-end HTTP components disagree on request boundaries - typically through ambiguous Transfer-Encoding/Content-Length handling - letting an attacker prepend or hide a second request within a single TCP stream. In WebSphere deployments fronted by reverse proxies or load balancers, this desynchronization can poison the connection and route the smuggled request as if it originated from a trusted upstream context. Affected CPEs cpe:2.3:a:ibm:websphere_application_server and cpe:2.3:a:ibm:websphere_application_server_-_liberty cover both the traditional and Liberty product lines.

RemediationAI

Patch available per vendor advisory - apply the IBM-provided interim fixes for traditional WebSphere 8.5 and 9.0 and upgrade Liberty beyond 26.0.0.6 as instructed at https://www.ibm.com/support/pages/node/7276579 (also see https://nvd.nist.gov/vuln/detail/CVE-2026-8646 and https://vuldb.com/vuln/372713). Until the fix is deployed, place WebSphere behind an HTTP-aware proxy that strictly rejects ambiguous Transfer-Encoding and Content-Length combinations, enforces HTTP/1.1 request normalization, and disables connection reuse from proxy to origin (trade-off: increased latency and load on the application server). Where possible, terminate TLS and HTTP/2 at a single hardened front end and forward only HTTP/2 to WebSphere to eliminate the keep-alive desync surface, and tighten WAF rules to drop requests with duplicate or conflicting framing headers.