CVE-2026-15634 is an HTTP request smuggling vulnerability in IBM WebSphere Application Server 9.0 and 8.5, caused by inconsistent interpretation of the HTTP transfer-encoding header. An attacker can exploit this by sending crafted HTTP requests that manipulate how the server processes transfer-encoding headers, enabling cache poisoning, firewall bypass, and XSS attacks. The vulnerability arises from improper parsing of the transfer-encoding request header, classified under CWE-444.

Successful exploitation can lead to web cache poisoning, allowing attackers to serve malicious content to users. It also enables bypassing web application firewall protections, increasing the risk of further attacks. Additionally, it can facilitate cross-site scripting (XSS) attacks, potentially compromising user data confidentiality and integrity. The CVSS score of 6.5 reflects a medium impact with low confidentiality and integrity impact and no availability impact.

No specific patch or remediation details are provided in the available data. Patch status is not yet confirmed — check IBM's official advisory for current remediation guidance. Until a fix is available, consider implementing network-level protections that detect and block malformed transfer-encoding headers if possible.