CVE-2026-11541: HTTP Request Smuggling in IBM WebSphere and CICS

Technical summary

CVE-2026-11541 is an HTTP request smuggling vulnerability (CWE-444) affecting IBM WebSphere Application Server versions 8.5, 9.0, and Liberty editions from 17.0.0.3 through 26.0.0.6, as well as IBM CICS Transaction Gateway for Multiplatforms versions 9.1, 9.2, 9.3, and 10.1. The vulnerability arises from improper handling of HTTP request boundaries, allowing attackers with network access to construct requests that are interpreted differently by front-end and back-end components. The attack requires specific conditions (AC:H in CVSS terms) but can result in confidentiality and integrity breaches without requiring user interaction or elevated privileges.

Business impact

HTTP request smuggling in a widely-deployed application server platform creates significant enterprise risk. Attackers gaining the ability to bypass authentication layers, inject malicious content, or access restricted data could lead to compliance violations, data breaches, and reputational harm. Organizations running affected versions in customer-facing or internal-critical roles face exposure to session hijacking, cache poisoning, and lateral movement within trusted network zones. The HIGH severity rating reflects the potential for substantial impact despite the vulnerability requiring non-trivial exploitation conditions.

Affected systems

IBM WebSphere Application Server 8.5 and 9.0 (all patch levels unless patched) are in scope. WebSphere Application Server Liberty editions from 17.0.0.3 through 26.0.0.6 require review—newer versions may or may not be affected; consult IBM's advisory. IBM CICS Transaction Gateway for Multiplatforms versions 9.1, 9.2, 9.3, and 10.1 are confirmed affected. Any organization deploying these versions should assess whether systems are internet-facing, process untrusted HTTP requests, or sit behind proxies or load balancers that may mask HTTP inconsistencies.

Exploitability

Exploitation requires network-level access (remote, unauthenticated) but involves high attack complexity. The attacker must understand or discover how the specific deployment parses HTTP requests—including header handling, content-length vs. transfer-encoding precedence, and request framing logic. Success depends on target configuration and what sits upstream (reverse proxies, WAFs, API gateways). While not trivial, this is within reach of determined threat actors targeting high-value systems. The vulnerability is not yet tracked on CISA's Known Exploited Vulnerabilities catalog, but should be considered for active monitoring.

Remediation

Patch immediately if patches are available from IBM for your specific product version. For IBM WebSphere Application Server, check IBM's security bulletin for fixed versions; similarly, obtain fixed versions of CICS Transaction Gateway from IBM. If patches are unavailable or deployment timeline is constrained, implement compensating controls: restrict HTTP traffic to trusted clients only, deploy a WAF configured to detect and block request smuggling patterns, and place affected systems behind a reverse proxy that enforces strict HTTP parsing rules. Validate that any upstream proxy correctly normalizes requests before forwarding.

Patch guidance

Consult IBM's official security advisory for CVE-2026-11541 to identify the specific fixed versions for your WebSphere Application Server or CICS Transaction Gateway deployment. IBM typically releases fixes as cumulative fix packs or point releases; do not rely on third-party version numbers. Test patches in a non-production environment, paying attention to any deprecated features or configuration changes in release notes. Schedule patching during a controlled maintenance window, coordinating with any dependent applications or middleware that relies on these servers. Verify patch installation by checking product version output and confirming the CVE is addressed in the fixed version's security documentation.

Detection guidance

Monitor HTTP access logs and reverse proxy/load balancer logs for unusual request patterns: multiple Content-Length headers, conflicting Content-Length and Transfer-Encoding headers, or requests with ambiguous framing. Web Application Firewalls (WAF) and intrusion detection systems (IDS) should be tuned to flag HTTP request smuggling signatures. Review WebSphere Application Server access logs for evidence of requests that reach unexpected endpoints or bypass authentication. Consider deploying network-level detection for CWE-444 patterns. If suspicious activity is identified, capture full request/response headers and consult IBM support. Baseline normal traffic to distinguish attack attempts from misconfigured clients.

Why prioritize this

This vulnerability merits urgent attention for any organization running affected IBM WebSphere or CICS versions. The HIGH CVSS score, remote attack vector, and potential for authentication bypass or data theft create material risk to business operations and compliance posture. Although attack complexity is elevated, the broad installed base of WebSphere and the likelihood of future public exploit development increase priority. Organizations should prioritize patching or compensating controls within 30 days, faster if systems are customer-facing or process sensitive data.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) reflects a remotely exploitable vulnerability with high impact on confidentiality and integrity, offset by high attack complexity. The attack vector is network-based and requires no privileges or user interaction, making broad scanning and exploitation feasible. However, the attacker must craft requests that successfully exploit parsing inconsistencies, which varies by configuration and upstream infrastructure. The lack of availability impact (A:N) prevents a CRITICAL rating. For organizations with internet-exposed WebSphere deployments or untrusted network segments, the practical risk may be higher; those with strict segmentation and proxy controls may assess lower operational risk.

Frequently asked questions