PT-2026-43363 · Ibm · Web Server Plug-Ins For Websphere Application Server/Websphere Liberty+1

CVE-2026-8620 · Published 2026-05-26 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty versions 8.5 through 9.0

Description IBM WebSphere Application Server and WebSphere Application Server Liberty are susceptible to HTTP request smuggling within the Web Server Plug-ins. This occurs when the system processes a specially crafted HTTP request, allowing an attacker to interfere with the way a website processes sequences of HTTP requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-8620

Affected Products

Web Server Plug-Ins For Websphere Application Server/Websphere Liberty

Ibm Websphere Application Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-8620 · Security Note
• https://twitter.com/knaepp/status/2059379056194228610 · Twitter Post
• https://ibm.com/support/pages/node/7274072 · Patch, Vendor Advisory
• https://twitter.com/knaepp/status/2059297265701863578 · Twitter Post