CVE-2026-15396 is an HTTP request smuggling vulnerability in IBM WebSphere Application Server 8.5 and 9.0 caused by inconsistent interpretation of the HTTP transfer-encoding request header. An attacker can exploit this by sending specially crafted HTTP requests that manipulate how the server parses transfer-encoding headers, leading to cache poisoning, firewall bypass, and XSS attacks.

Successful exploitation can lead to web cache poisoning, allowing attackers to serve malicious content to users. It also enables bypassing of web application firewall protections and facilitates cross-site scripting attacks, potentially compromising user data and session integrity. The vulnerability does not impact availability and requires no privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, organizations should monitor IBM advisories for updates and consider implementing network-level protections to detect and block suspicious HTTP transfer-encoding headers.