Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| IBM | CICS Transaction Gateway for Multiplatforms | affected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Ibm | Websphere Application Server | 95% |
|
||||||||||||
| Ibm | Websphere Application Server Liberty | 95% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Vendor Solution
IBM strongly recommends addressing the vulnerabilities now by downloading and applying the CICS Transaction Gateway for Multiplatforms fixes. Product VRMF APAR Remediation/First Fix CICS Transaction Gateway for Multiplatforms9.1.0.0 - PSIRT fixes for CICS Transaction Gateway for Multiplatforms will be provided only to customers covered by Extended Support and only upon request through an IBM Support case. CICS Transaction Gateway for Multiplatforms9.2.0.0 PH72094 AIX Link https://www.ibm.com/support/fixcentral/quickorder pLinux Big Endian Link https://www.ibm.com/support/fixcentral/quickorder Windows Link https://www.ibm.com/support/fixcentral/quickorder iLinux Link https://www.ibm.com/support/fixcentral/quickorder zLinux Link https://www.ibm.com/support/fixcentral/quickorder CICS Transaction Gateway for Multiplatforms9.3.0.0 PH72094 AIX Link https://www.ibm.com/support/fixcentral/quickorder pLinux Little Endian Link https://www.ibm.com/support/fixcentral/quickorder pLinux Big Endian Link https://www.ibm.com/support/fixcentral/quickorder Windows Link https://www.ibm.com/support/fixcentral/quickorder iLinux Link https://www.ibm.com/support/fixcentral/quickorder zLinux Link https://www.ibm.com/support/fixcentral/quickorder x86 Container Link https://www.ibm.com/support/fixcentral/quickorder 390x Container Link https://www.ibm.com/support/fixcentral/quickorder CICS Transaction Gateway for Multiplatforms10.1.0.0 PH72095 AIX Link https://www.ibm.com/support/fixcentral/quickorder pLinux Little Endian Link https://www.ibm.com/support/fixcentral/quickorder Windows Link https://www.ibm.com/support/fixcentral/quickorder iLinux Link https://www.ibm.com/support/fixcentral/quickorder zLinux Link https://www.ibm.com/support/fixcentral/quickorder x86 Container Link https://www.ibm.com/support/fixcentral/quickorder 390x Container Link https://www.ibm.com/support/fixcentral/quickorder
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://www.ibm.com/support/pages/node/7281750 |
|
Wed, 29 Jul 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability. | IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability. |
| Title | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling | Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms. |
| CPEs | cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.6:*:*:*:*:*:*:* |
|
| References |
Wed, 01 Jul 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 30 Jun 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability. | |
| Title | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling | |
| First Time appeared |
Ibm
Ibm websphere Application Server Ibm websphere Application Server Liberty |
|
| Weaknesses | CWE-444 | |
| CPEs | cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.6:*:*:*:*:*:*:* |
|
| Vendors & Products |
Ibm
Ibm websphere Application Server Ibm websphere Application Server Liberty |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: ibm
Published:
Updated: 2026-07-29T18:12:49.178Z
Reserved: 2026-06-08T02:55:08.653Z
Link: CVE-2026-11541
Vulnrichment
Updated: 2026-07-01T14:52:11.835Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-07-01T04:45:05Z
-
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')