CVE-2026-11541

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11541", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-06-08T02:55:08.653Z", "datePublished": "2026-06-30T20:56:04.135Z", "dateUpdated": "2026-07-29T18:12:49.178Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-07-29T18:12:49.178Z"}, "title": "Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "CICS Transaction Gateway for Multiplatforms", "versions": [{"status": "affected", "version": "9.1"}, {"status": "affected", "version": "9.2"}, {"status": "affected", "version": "9.3"}, {"status": "affected", "version": "10.1"}]}], "descriptions": [{"lang": "en", "value": "IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7281750", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerabilities now by downloading and applying the CICS Transaction Gateway for Multiplatforms fixes.\n\n\n\nProduct\n\nVRMF\n\nAPAR\n\nRemediation/First Fix\n\nCICS Transaction Gateway for Multiplatforms9.1.0.0\n\n-\n\nPSIRT fixes for CICS Transaction Gateway for Multiplatforms will be provided only to customers covered by Extended Support and only upon request through an IBM Support case.\n\nCICS Transaction Gateway for Multiplatforms9.2.0.0\n\nPH72094\n\n\n\n AIX Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n pLinux Big Endian Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n Windows Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n iLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n zLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n\n\nCICS Transaction Gateway for Multiplatforms9.3.0.0\n\nPH72094\n\n\n\n AIX Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n pLinux Little Endian Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n pLinux Big Endian Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n Windows Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n iLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n zLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n x86 Container Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n 390x Container Link https://www.ibm.com/support/fixcentral/quickorder \n\nCICS Transaction Gateway for Multiplatforms10.1.0.0\n\nPH72095\n\n\n\n AIX Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n pLinux Little Endian Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n Windows Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n iLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n zLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n x86 Container Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n 390x Container Link https://www.ibm.com/support/fixcentral/quickorder", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><p><strong>IBM strongly recommends addressing the vulnerabilities now by downloading and applying the CICS Transaction Gateway for Multiplatforms fixes.</strong></p></div><div><table><tbody><tr><td><div><strong>Product</strong></div></td><td><div><strong>VRMF</strong></div></td><td><div><strong>APAR</strong></div></td><td><div><strong>Remediation/First Fix</strong></div></td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>9.1.0.0</td><td><p>-</p></td><td><div>PSIRT fixes for CICS Transaction Gateway for Multiplatforms will be provided only to customers covered by Extended Support and only upon request through an IBM Support case.</div></td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>9.2.0.0</td><td><p>PH72094</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.2.0.2-CICSTG-PH72094-AIX&amp;source=SAR\" rel=\"nofollow\">AIX Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.2.0.2-CICSTG-PH72094-PLNX&amp;source=SAR\" rel=\"nofollow\">pLinux Big Endian Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.2.0.2-CICSTG-PH72094-WIN&amp;source=SAR\" rel=\"nofollow\">Windows Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.2.0.2-CICSTG-PH72094-ILNX&amp;source=SAR\" rel=\"nofollow\">iLinux Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.2.0.2-CICSTG-PH72094-ZLNX&amp;source=SAR\" rel=\"nofollow\">zLinux Link</a></p><p></p></td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>9.3.0.0</td><td><p>PH72094</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-AIX&amp;source=SAR\" rel=\"nofollow\">AIX Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-PLXLE&amp;source=SAR\" rel=\"nofollow\">pLinux Little Endian Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-PLNX&amp;source=SAR\" rel=\"nofollow\">pLinux Big Endian Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-WIN&amp;source=SAR\" rel=\"nofollow\">Windows Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-ILNX&amp;source=SAR\" rel=\"nofollow\">iLinux Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-ZLNX&amp;source=SAR\" rel=\"nofollow\">zLinux Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-x86Container&amp;source=SAR\" rel=\"nofollow\">x86 Container Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-s390xContainer&amp;source=SAR\" rel=\"nofollow\">390x Container Link</a></p></td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>10.1.0.0</td><td><p>PH72095</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-AIX&amp;source=SAR\" rel=\"nofollow\">AIX Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-PLXLE&amp;source=SAR\" rel=\"nofollow\">pLinux Little Endian Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-WIN&amp;source=SAR\" rel=\"nofollow\">Windows Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-ILNX&amp;source=SAR\" rel=\"nofollow\">iLinux Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-ZLNX&amp;source=SAR\" rel=\"nofollow\">zLinux Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-x86Container&amp;source=SAR\" rel=\"nofollow\">x86 Container Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-s390xContainer&amp;source=SAR\" rel=\"nofollow\">390x Container Link</a></p></td></tr></tbody></table></div><p></p>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-01T14:52:04.153923Z", "id": "CVE-2026-11541", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T14:52:15.909Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11541", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-01T14:52:04.153923Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T14:52:11.835Z"}}], "cna": {"title": "Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "IBM", "product": "CICS Transaction Gateway for Multiplatforms", "versions": [{"status": "affected", "version": "9.1"}, {"status": "affected", "version": "9.2"}, {"status": "affected", "version": "9.3"}, {"status": "affected", "version": "10.1"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerabilities now by downloading and applying the CICS Transaction Gateway for Multiplatforms fixes.\n\n\n\nProduct\n\nVRMF\n\nAPAR\n\nRemediation/First Fix\n\nCICS Transaction Gateway for Multiplatforms9.1.0.0\n\n-\n\nPSIRT fixes for CICS Transaction Gateway for Multiplatforms will be provided only to customers covered by Extended Support and only upon request through an IBM Support case.\n\nCICS Transaction Gateway for Multiplatforms9.2.0.0\n\nPH72094\n\n\n\n AIX Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n pLinux Big Endian Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n Windows Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n iLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n zLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n\n\nCICS Transaction Gateway for Multiplatforms9.3.0.0\n\nPH72094\n\n\n\n AIX Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n pLinux Little Endian Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n pLinux Big Endian Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n Windows Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n iLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n zLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n x86 Container Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n 390x Container Link https://www.ibm.com/support/fixcentral/quickorder \n\nCICS Transaction Gateway for Multiplatforms10.1.0.0\n\nPH72095\n\n\n\n AIX Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n pLinux Little Endian Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n Windows Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n iLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n zLinux Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n x86 Container Link https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n 390x Container Link https://www.ibm.com/support/fixcentral/quickorder", "supportingMedia": [{"type": "text/html", "value": "<div><p><strong>IBM strongly recommends addressing the vulnerabilities now by downloading and applying the CICS Transaction Gateway for Multiplatforms fixes.</strong></p></div><div><table><tbody><tr><td><div><strong>Product</strong></div></td><td><div><strong>VRMF</strong></div></td><td><div><strong>APAR</strong></div></td><td><div><strong>Remediation/First Fix</strong></div></td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>9.1.0.0</td><td><p>-</p></td><td><div>PSIRT fixes for CICS Transaction Gateway for Multiplatforms will be provided only to customers covered by Extended Support and only upon request through an IBM Support case.</div></td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>9.2.0.0</td><td><p>PH72094</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.2.0.2-CICSTG-PH72094-AIX&amp;source=SAR\" rel=\"nofollow\">AIX Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.2.0.2-CICSTG-PH72094-PLNX&amp;source=SAR\" rel=\"nofollow\">pLinux Big Endian Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.2.0.2-CICSTG-PH72094-WIN&amp;source=SAR\" rel=\"nofollow\">Windows Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.2.0.2-CICSTG-PH72094-ILNX&amp;source=SAR\" rel=\"nofollow\">iLinux Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.2.0.2-CICSTG-PH72094-ZLNX&amp;source=SAR\" rel=\"nofollow\">zLinux Link</a></p><p></p></td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>9.3.0.0</td><td><p>PH72094</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-AIX&amp;source=SAR\" rel=\"nofollow\">AIX Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-PLXLE&amp;source=SAR\" rel=\"nofollow\">pLinux Little Endian Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-PLNX&amp;source=SAR\" rel=\"nofollow\">pLinux Big Endian Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-WIN&amp;source=SAR\" rel=\"nofollow\">Windows Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-ILNX&amp;source=SAR\" rel=\"nofollow\">iLinux Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-ZLNX&amp;source=SAR\" rel=\"nofollow\">zLinux Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-x86Container&amp;source=SAR\" rel=\"nofollow\">x86 Container Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=9.3.0.0-CICSTG-PH72094-s390xContainer&amp;source=SAR\" rel=\"nofollow\">390x Container Link</a></p></td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>10.1.0.0</td><td><p>PH72095</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-AIX&amp;source=SAR\" rel=\"nofollow\">AIX Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-PLXLE&amp;source=SAR\" rel=\"nofollow\">pLinux Little Endian Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-WIN&amp;source=SAR\" rel=\"nofollow\">Windows Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-ILNX&amp;source=SAR\" rel=\"nofollow\">iLinux Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-ZLNX&amp;source=SAR\" rel=\"nofollow\">zLinux Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-x86Container&amp;source=SAR\" rel=\"nofollow\">x86 Container Link</a></p><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&amp;fixids=10.1.0.0-CICSTG-PH72095-s390xContainer&amp;source=SAR\" rel=\"nofollow\">390x Container Link</a></p></td></tr></tbody></table></div><p></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7281750", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-07-29T18:12:49.178Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11541", "state": "PUBLISHED", "dateUpdated": "2026-07-29T18:12:49.178Z", "dateReserved": "2026-06-08T02:55:08.653Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-06-30T20:56:04.135Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "CICS Transaction Gateway for Multiplatforms", "vendor": "IBM", "versions": [{"status": "affected", "version": "9.1"}, {"status": "affected", "version": "9.2"}, {"status": "affected", "version": "9.3"}, {"status": "affected", "version": "10.1"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:*", "matchCriteriaId": "D0F3A34A-A76C-4929-A3A4-B17271E8B193", "versionEndExcluding": "8.5.5.31", "versionStartIncluding": "8.5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:*", "matchCriteriaId": "2A4B3C11-FDA8-48D6-997F-48EEA8C3CB2C", "versionEndExcluding": "9.0.5.29", "versionStartIncluding": "9.0.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:*", "matchCriteriaId": "A7115371-D210-4CA1-82E8-36A2B966255A", "versionEndIncluding": "26.0.0.6", "versionStartIncluding": "17.0.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability."}, {"lang": "es", "value": "IBM WebSphere Application Server 9.0 y 8.5 e IBM WebSphere Application Server - Liberty 17.0.0.3 hasta 26.0.0.6 se ven afectados por una vulnerabilidad de contrabando de solicitudes HTTP."}], "id": "CVE-2026-11541", "lastModified": "2026-10-25T21:10:00.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11541", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-01T14:52:04.153923Z", "version": "2.0.3"}}]}, "published": "2026-06-30T22:16:46.317", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7281750"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8.5"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "WebSphere Application Server", "source": "cna", "vendor": "IBM"}, "product": "websphere_application_server", "vendor": "ibm"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17.0.0.3,26.0.0.6]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "WebSphere Application Server - Liberty", "source": "cna", "vendor": "IBM"}, "product": "websphere_application_server___liberty", "vendor": "ibm"}], "created": "2026-06-30T23:45:05.443552+00:00", "updated": "2026-08-04T08:15:06.301707+00:00", "vendors": ["ibm", "ibm$PRODUCT$websphere_application_server", "ibm$PRODUCT$websphere_application_server___liberty"]}