CVE-2026-8620

HighCVSS 7.5/10Last modified Jul 23, 2026

Description

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to HTTP request smuggling in the Web Server Plug-ins through a specially crafted request.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-444

Affected software

Vendor	Product	Versions
IBM	Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty	>= 8.5, 9.0, <= Interim Fix 002

References

https://www.ibm.com/support/pages/node/7274072Patch, Vendor Advisory

Timeline

Published: May 26, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-862005.3PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to fl CVE-2026-862017.5PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknow CVE-2026-862024.3PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigg CVE-2026-862033.7PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploi CVE-2026-862046.5PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to CVE-2026-862055.4h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative CVE-2026-862066.9A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central CVE-2026-862077.7An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs CVE-2026-862087.3A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /d CVE-2026-862097.3A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_CVE-2026-86218.8Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other own CVE-2026-862107.3A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unk