Reference page — cumulative record through Monday, October 5, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-11541
IBM CICS Transaction Gateway for Multiplatforms — Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H H H 9.8 .0042 33.7 —
AFFECTED
Product Versions Fixed
CICS Transaction Gateway for Multiplatforms 9.1 – —
TIMELINE
Jun 8 Reserved by ibm
Jun 30 Published (CNA: ibm)
Jul 29 RESCORED — CVE-2026-11541 (IBM CICS Transaction Gateway for Multiplatforms). CVSS 7.4 → 9.8 (NVD).
Description
IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 8, 2026 | Reserved | Reserved by ibm |
| June 30, 2026 | Published | Published (CNA: ibm) |
| July 29, 2026 | RESCORED | RESCORED — CVE-2026-11541 (IBM CICS Transaction Gateway for Multiplatforms). CVSS 7.4 → 9.8 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| IBM | CICS Transaction Gateway for Multiplatforms | — | 9.1 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-11541 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 5, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
