CVE-2026-8646

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

At a glance

Severity: HIGH 7.4
EPSS: EPSS 0.59 % · percentile 48 (2026-10-27)
State: PUBLISHED
Published: 2026-06-22
Updated: 2026-06-24
Assigner: ibm
NVD status: Analyzed

Description

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	ibm
CVSS 3.1	HIGH 7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	NVD · psirt@us.ibm.com (Secondary)
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-444

European references

ENISA EUVD · EUVD-2026-38251
GCVE · GCVE-0-2026-8646

CERT-FR advisories

CERTFR-2026-AVI-1206 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1032 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0933 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0834 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0788 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* ≥ 8.5.0.0 < 8.5.5.30
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* ≥ 9.0.0.0 < 9.0.5.29
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:* ≥ 17.0.0.3 < 26.0.0.7

Affected products

Product	Versions
IBM · WebSphere Application Server	affected 9.0.0 ≤ 7.0.2 Interim Fix 035 ; affected 8.5.0 ≤ 7.0.3 Interim Fix 017
IBM · WebSphere Application Server - Liberty	affected 17.0.0.3 ≤ 26.0.0.6

References

https://www.ibm.com/support/pages/node/7276579

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD