CVE-2026-15325 is an HTTP request smuggling vulnerability in IBM WebSphere Application Server and its Liberty variant. The flaw arises from improper handling of TRACE HTTP requests, which can cause inconsistent interpretation of HTTP requests between front-end and back-end servers. This inconsistency may allow attackers to smuggle malicious requests, potentially leading to unauthorized access or data compromise. The vulnerability affects versions 8.5 through 9.0 inclusive. The CVSS v3.1 base score is 8.7, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact. As of the published date, no official patch or remediation level is documented.

Successful exploitation of this vulnerability could allow an attacker to bypass security controls by smuggling HTTP requests, leading to unauthorized disclosure or modification of sensitive information. The confidentiality and integrity of the affected system are at high risk, while availability is not impacted. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting TRACE HTTP method usage if feasible to reduce exposure. Monitor IBM's security advisories for updates on patches or official mitigations.