CVE-2026-15064 affects IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7. The vulnerability arises from improper handling of non-standard HTTP version tokens, enabling HTTP Response Smuggling attacks. This can allow attackers to interfere with the processing of HTTP requests and responses, potentially leading to confidentiality and integrity breaches. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, scope changed, and high impact on confidentiality and integrity, with no impact on availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information and unauthorized modification of data (confidentiality and integrity impacts are high). Availability is not impacted. The vulnerability allows an attacker to smuggle HTTP responses by exploiting improper parsing of HTTP version tokens, which can disrupt normal HTTP communication and potentially bypass security controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor IBM's security advisories for updates and apply patches once available. Until then, consider implementing network-level mitigations such as strict HTTP protocol validation and web application firewall rules to detect and block suspicious HTTP requests.