IBMCVE-2026-10841

IBM CICS TX Advanced: request smuggling

Medium4.2CVE-2026-10841 · Published Sep 18, 2026

IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling.

Affected versions

Package	Affected	Fixed in
CICS TX Advanced Product	<= 10.1	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-444

More IBM advisories

Date	Advisory	Severity	Fixed in
Sep 18	IBM Guardium Data Protection: improper authorization High8.1Sep 18 CVE-2026-84241No fix yet	High8.1	No fix yet
Sep 18	IBM Guardium Data Protection: cross-site request forgery High8.8Sep 18 CVE-2026-84084No fix yet	High8.8	No fix yet
Sep 18	IBM Guardium Data Protection: command injection High8.1Sep 18 CVE-2026-84085No fix yet	High8.1	No fix yet
Sep 18	IBM Guardium Data Protection: remote code execution High7.2Sep 18 CVE-2026-84086No fix yet	High7.2	No fix yet
Sep 18	IBM Guardium Data Protection: privilege escalation High7.8Sep 18 CVE-2026-84089No fix yet	High7.8	No fix yet
Sep 18	IBM Guardium Data Protection: information disclosure High7.7Sep 18 CVE-2026-84105No fix yet	High7.7	No fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.