Paper/Archive/CVE-2026-11541

CVE-2026-11541

IBM CICS Transaction Gateway for Multiplatforms — Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 35.9.359 × 207.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.

Affected

ProductAffectedFixed inSource

CICS Transaction Gateway for Multiplatforms9.1–CNA

CICS Transaction Gateway for Multiplatforms9.2–CNA

CICS Transaction Gateway for Multiplatforms9.3–CNA

CICS Transaction Gateway for Multiplatforms10.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ibm (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchibm.com/support/pages/node/7281750