CVE-2026-11546
Received Received - Intake

Server-Side Request Forgery in IBM WebSphere Liberty

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: IBM Corporation

Description
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-30
Last Modified
2026-06-30
Generated
2026-07-01
AI Q&A
2026-06-30
EPSS Evaluated
N/A
NVD
CVE-2026-11546
EUVD
EUVD-2026-40399

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm websphere_application_server_liberty From 17.0.0.3 (inc) to 26.0.0.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-11546 is a server-side request forgery (SSRF) vulnerability affecting IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 when the adminCenter-1.0 feature is enabled.

This vulnerability allows an attacker to make unauthorized requests from the server, potentially leading to unauthorized access and impacting system availability.

Impact Analysis

The vulnerability has a high severity with a CVSS base score of 7.1, indicating significant risk.

  • Potential unauthorized access to internal resources.
  • Impact on system availability, possibly causing denial of service.

Because the vulnerability involves server-side request forgery, attackers could exploit it to send unauthorized requests from the server, which may compromise security and disrupt operations.

Detection Guidance

To detect this vulnerability, you should verify if the adminCenter-1.0 feature is enabled in your IBM WebSphere Application Server Liberty installation, as the vulnerability only occurs when this feature is active.

No specific detection commands or network scanning techniques are provided in the available resources.

Mitigation Strategies

IBM recommends applying an interim fix identified as APAR PH71841 or upgrading to Liberty Fix Pack 26.0.0.8 or later to mitigate this vulnerability.

Currently, there are no workarounds available, so verifying the status of the adminCenter-1.0 feature and applying the recommended fix or upgrade is critical.

Compliance Impact

The vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-11546) is a server-side request forgery (SSRF) issue that can lead to potential unauthorized access and impact system availability.

Such unauthorized access and availability impacts could potentially affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.

However, the provided information does not explicitly describe the direct effects of this vulnerability on compliance with these standards.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11546. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart