CVE-2026-8646 is an HTTP request smuggling vulnerability in IBM WebSphere Application Server versions 9.0.0 and 8.5.0, including Liberty versions 17.0.0.3 through 26.0.0.6. The vulnerability arises from inconsistent interpretation of HTTP requests, enabling a remote attacker to smuggle crafted requests to the server. This can lead to bypassing security controls, identity spoofing, privilege escalation, and exposure of sensitive data. The CVSS 3.1 base score is 7.4, indicating high severity. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow remote attackers to bypass security controls, spoof identities, escalate privileges, and access sensitive information on affected IBM WebSphere Application Server instances. The vulnerability does not impact availability but has high confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing network-level protections such as web application firewalls that can detect and block HTTP request smuggling attempts. Monitor IBM's security advisories for updates and patches addressing this vulnerability.