CVE-2026-15325 affects IBM WebSphere Application Server 8.5, 9.0, and Liberty versions 17.0.0.3 through 26.0.0.7. The vulnerability arises from improper handling of HTTP TRACE requests, enabling HTTP request smuggling attacks. This can allow an attacker to bypass security controls and interfere with the processing of HTTP requests, impacting confidentiality and integrity of data. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, scope changed, and high impact on confidentiality and integrity but no impact on availability. No patch or official remediation information is provided in the input.

Successful exploitation can lead to high impact on confidentiality and integrity of data processed by the affected IBM WebSphere Application Server versions. Attackers may be able to smuggle HTTP requests, potentially bypassing security controls or interfering with normal request processing. There is no reported impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting HTTP TRACE method handling if feasible, as it is the root cause of this vulnerability. Monitor vendor communications for updates on patches or official mitigations.