CVE-2026-11541 is an HTTP request smuggling vulnerability affecting IBM CICS Transaction Gateway for Multiplatforms (versions 9.1, 9.2, 9.3, and 10.1) and IBM WebSphere Application Server (versions 9.0, 8.5, and Liberty 17.0.0.3 through 26.0.0.6). The vulnerability arises from inconsistent interpretation of HTTP requests (CWE-444), potentially allowing an attacker to interfere with HTTP request processing. The CVSS v3.1 base score is 7.4, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts. As of the published date, no official remediation or patch is documented.

Successful exploitation can lead to unauthorized disclosure and modification of information due to HTTP request smuggling. The vulnerability does not affect availability. It requires no privileges or user interaction but has high attack complexity, limiting ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, monitor IBM communications for updates. No specific mitigation steps are provided in the current data.