IBM WebSphere Liberty CVE-2026-11546

Exploitation requires that the target Liberty server have the adminCenter-1.0 feature explicitly enabled in its configuration (server.xml) - this is the exact named prerequisite from the CVE description and is not enabled by default on a minimal Liberty server, so instances without Admin Center are not exploitable. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is needed once the feature is reachable, meaning remote unauthenticated exploitation against a Liberty server with Admin Center exposed to the attacker's network. Practical exploitation is further limited by whether the Admin Center endpoint is reachable (management consoles are often bound to internal networks) and by what internal targets the SSRF can reach given the host's egress rules; CISA SSVC also records Exploitation: none and the impact as partial, indicating no observed exploitation to date.

The signals here conflict sharply and warrant caution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) portrays a trivially exploitable, network-reachable, unauthenticated flaw with high confidentiality, integrity, and availability impact - but for a classic SSRF the C:H/I:H/A:H rating is aggressive and likely reflects worst-case pivoting into sensitive internal services rather than direct RCE. Countervailing signals temper this: EPSS is only 0.21% (12th percentile), CISA SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, and there is no public exploit identified at time of analysis and no CISA KEV listing. The SSVC 'partial' technical impact directly contradicts the CVSS 'total' (C/I/A all High) framing, suggesting the 9.8 overstates real-world severity. Net assessment: a genuinely serious flaw where the adminCenter-1.0 feature is enabled and internet-exposed, but with no evidence of active or automatable exploitation, this is a high-priority patch item rather than an emergency drop-everything event - prioritize instances that expose Admin Center beyond a trusted management network.

An attacker who can reach an internet-exposed Liberty Admin Center sends a crafted request to the vulnerable adminCenter-1.0 handler, supplying a URL pointing at an internal-only resource such as a cloud metadata service or an internal management API. The server dutifully makes the outbound request and returns or acts on the response, letting the attacker enumerate and reach internal services from the trust position of the application server. No public exploit is identified at time of analysis, and the low EPSS and SSVC 'Exploitation: none' rating indicate this remains theoretical for now.