IBM WebSphere flaws expose Liberty and IBM i deployments to request smuggling and RCE

IBM disclosed multiple vulnerabilities in WebSphere Application Server and WebSphere Application Server Liberty, including denial-of-service issues tracked as CVE-2026-9071 and CVE-2026-9320, and an HTTP request smuggling flaw, CVE-2026-8646, rated up to CVSS 8.1. The affected products include WebSphere Application Server 8.5 and 9.0, along with WebSphere Liberty versions 17.0.0.3 through 26.0.0.6 when certain servlet or websocket features are enabled. IBM said no workarounds or mitigations are available and advised customers to apply interim fixes for APAR PH71631 and PH71370 or upgrade to fix packs 26.0.0.7, 9.0.5.29, or 8.5.5.30.

A related high-severity issue, CVE-2026-9072, affects IBM i 7.3 through 7.6 in environments using WebSphere Application Server or Liberty with Intelligent Management and the WebSphere WebServer Plug-in. IBM said an attacker who can impersonate backend servers and send crafted responses to the plug-in could trigger remote code execution and denial of service, also with a CVSS 8.1 rating. Recommended actions include installing the latest WebSphere security updates, updating IBM i to current levels, and reviewing the secure configuration of Intelligent Management and the WebSphere WebServer Plug-in.