CVE-2026-15325
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
02 Description
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 0.34% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 27.3% of scored records. A rank, not a probability.
- NVD base score
- 8.7 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-08-06.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-07-28 20:07Z3 MO AGO
- Last updated
- 2026-08-06 20:24Z2 MO AGO
- Reserved
- 2026-07-09
- Assigning CNA
- ibm
- Record state
- PUBLISHED
- Severity
- High (CVSS 8.7)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
- Weaknesses
- CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')Base
- Data version
- 5.2
- Document digest
- b21d3a13695b18c150a4a8783d46830c497adc257aa8d89467c4065b4f80ea15
05 Affected products
06 References
07 Remediation
IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH72191 or PH72192. To determine if a feature is enabled for WebSphere Application Server Liberty, refer to How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 . For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.7 using servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 feature(s): · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH72191 https://www.ibm.com/support/pages/node/7277460 --OR-- · Apply Fix Pack 26.0.0.8 or later (targeted availability 3Q2026). For IBM WebSphere Application Server traditional: For V9.0.0.0 through 9.0.5.28: · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH72192 https://www.ibm.com/support/pages/node/7281143 --OR-- · Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026). For V8.5.0.0 through 8.5.5.30: · Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix that resolves PH72192 https://www.ibm.com/support/pages/node/7281143 --OR-- · Apply Fix Pack 8.5.5.31 or later (targeted availability 3Q2026). Additional interim fixes may be available and linked off the interim fix download page.