CVE-2026-15634 describes an HTTP request smuggling vulnerability in IBM WebSphere Application Server 9.0, 8.5, and Liberty editions. The root cause is improper parsing of the HTTP transfer-encoding request header, which can be exploited by attackers to manipulate how HTTP requests are processed. Exploitation can lead to web cache poisoning, bypassing of web application firewall protections, and enabling XSS attacks. The CVSS v3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity.

Successful exploitation can allow attackers to poison web caches, bypass web application firewalls, and conduct cross-site scripting attacks, potentially compromising the confidentiality and integrity of web applications running on the affected IBM WebSphere Application Server versions. There is no indication of availability impact or known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor IBM's security advisories for updates and apply any official patches once released. Until then, consider implementing network-level protections or web application firewall rules that can detect and block malformed transfer-encoding headers.