CVE-2026-11541: HTTP Request Smuggling in IBM WebSphere, CICS TG

CVE-2026-11541 is a high-severity HTTP request smuggling flaw (CVSS 7.4) in IBM WebSphere Application Server 9.0 and 8.5, WebSphere Liberty 17.0.0.3 through 26.0.0.6, and IBM CICS Transaction Gateway for Multiplatforms 9.1 to 10.1. IBM provides fixes through APARs. Apply the fix for your product and version.

What's affected

From the CVE record and the IBM bulletin for CICS Transaction Gateway for Multiplatforms:

• IBM WebSphere Application Server: 9.0 and 8.5.
• IBM WebSphere Application Server Liberty: 17.0.0.3 through 26.0.0.6.
• IBM CICS Transaction Gateway for Multiplatforms: 9.1, 9.2, 9.3 and 10.1.
• Fixes for CICS Transaction Gateway: APAR PH72094 for 9.2 and 9.3, and APAR PH72095 for 10.1. For 9.1, IBM says fixes are provided only to customers with Extended Support, on request through an IBM Support case.
• Fixes for WebSphere and Liberty: the record points to the CICS bulletin only. Check IBM's WebSphere security bulletin for the fix level for your edition, because it was not retrieved for this review.
• Weakness class: CWE-444 (inconsistent interpretation of HTTP requests).
• Severity: CVSS 7.4. The vector shows high attack complexity, no privileges and no user interaction, with High impact on confidentiality and integrity.
• Workarounds: the CICS bulletin lists none.

How to check if you're exposed

Find out which of the three products you run and at which version.

1. For Liberty, run the product information tool from the Liberty install and read the version:

<wlp_install>/bin/productInfo version

2. For traditional WebSphere Application Server, run the version tool in the install bin directory:

<was_install>/bin/versionInfo.sh

3. For CICS Transaction Gateway, check the installed version and fix level through your normal IBM tooling and compare with the APARs above.
4. Container images based on CICS Transaction Gateway 9.3 or 10.1 also need a rebuilt or updated image. IBM lists x86 and s390x container fixes.

In each command, replace the placeholder with your install path.

What to do now

1. Work out which of the three products you run and which version, using the checks above.
2. For CICS Transaction Gateway, apply the fix for your version: PH72094 for 9.2 and 9.3, PH72095 for 10.1. For 9.1, open an IBM Support case if you have Extended Support.
3. For WebSphere and Liberty, read the IBM WebSphere bulletin for this CVE and apply the interim fix or fix pack it names.
4. Rebuild and redeploy container images that bundle an affected release, and check that the running image is the new one.
5. Review the bulletin's other CVEs. The CICS bulletin covers several vulnerabilities, including a second request smuggling issue, so one fix pass covers more than this CVE.

Why it matters

HTTP request smuggling happens when two systems in a chain, such as a front end proxy and an application server, disagree about where one request ends and the next begins. An attacker can then hide a request inside another one. The server may treat it as a separate request that was never checked by the front end. The class is tracked as inconsistent interpretation of HTTP requests.

IBM does not publish the exact trigger for this CVE, and we do not guess at it. The practical risk is that controls placed at the front end, like authentication, filtering or routing rules, can be bypassed for the hidden request. The CVSS vector gives High impact on confidentiality and integrity, with attack complexity High because the attacker needs the right conditions between systems. Fixing the application server is the correct response, and a front end that normalizes requests adds a second layer.

Quick check

Sources

• Gold entry and CVE record: CVE-2026-11541.
• IBM security bulletin for CICS Transaction Gateway for Multiplatforms, initial publication 29 July 2026.

Last reviewed: 19 October 2026.