CVE-2026-11714
Received Received - Intake

Server-Side Request Forgery in IBM WebSphere Liberty

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: IBM Corporation

Description
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-30
Last Modified
2026-06-30
Generated
2026-07-01
AI Q&A
2026-06-30
EPSS Evaluated
N/A
NVD
CVE-2026-11714
EUVD
EUVD-2026-40395

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm websphere_application_server_liberty From 17.0.0.3 (inc) to 26.0.0.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-11714 is a server-side request forgery (SSRF) vulnerability affecting IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 when the apiDiscovery-1.0 feature is enabled.

This vulnerability allows an attacker to bypass authorization controls and potentially access or manipulate server resources without proper permission.

Impact Analysis

The vulnerability has a high severity score of 8.5, indicating it poses a significant risk.

Exploitation could lead to unauthorized access or manipulation of server resources, which may compromise the confidentiality and integrity of data.

There are no current workarounds, so affected users must apply an interim fix or upgrade to a fixed version to mitigate the risk.

Detection Guidance

To detect this vulnerability, you should first verify if the apiDiscovery-1.0 feature is enabled on your IBM WebSphere Application Server Liberty installations, as the vulnerability only affects systems with this feature enabled.

No specific detection commands or network detection methods are provided in the available resources.

Mitigation Strategies

IBM recommends applying the interim fix for APAR PH71873 or upgrading to Liberty Fix Pack 26.0.0.8 (expected in Q3 2026) to mitigate this vulnerability.

Currently, there are no workarounds available, so applying the fix or upgrade promptly is the best immediate step.

Additionally, users should check if the vulnerable apiDiscovery-1.0 feature is enabled and take action accordingly.

Compliance Impact

The provided information does not specify how the CVE-2026-11714 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11714. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart