CVE-2026-15064 is a vulnerability in IBM WebSphere Application Server 8.5 and 9.0 where improper handling of non-standard HTTP version tokens leads to HTTP Response Smuggling (CWE-444). This flaw causes inconsistent interpretation of HTTP requests and responses, which can be exploited to compromise confidentiality and integrity of communications. The CVSS 3.1 base score is 8.7, indicating high severity with network attack vector, high attack complexity, no privileges or user interaction required, and scope changed. IBM has published the vulnerability but has not yet provided a remediation level or patch.

Successful exploitation can lead to a complete compromise of confidentiality and integrity of HTTP communications processed by the affected WebSphere Application Server versions. The vulnerability does not impact availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor IBM advisories for updates and consider implementing network-level protections to detect or block suspicious HTTP request patterns related to HTTP Response Smuggling.