CVE-2026-15396 describes an HTTP request smuggling vulnerability in IBM WebSphere Application Server 9.0, 8.5, and Liberty editions. The root cause is improper parsing of the HTTP transfer-encoding request header, which can be exploited by attackers to manipulate how HTTP requests are processed. Successful exploitation can lead to web cache poisoning, bypassing of web application firewall protections, and execution of cross-site scripting attacks.

The vulnerability impacts confidentiality and integrity by enabling attackers to poison web caches and bypass security controls such as web application firewalls. It also allows for cross-site scripting attacks, which can compromise user sessions or deliver malicious payloads. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's security advisories for updates. Until a fix is available, consider applying any recommended temporary mitigations from IBM if published.