What is the CVSS score of CVE-2026-11546?

CVE-2026-11546 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM WebSphere Liberty are affected by CVE-2026-11546?

IBM WebSphere Application Server Liberty (versions 17.0.0.3-26.0.0.7) contains a critical server-side request forgery flaw that allows remote attackers to make arbitrary outbound requests when the…

How to fix or mitigate CVE-2026-11546?

Within 24 hours: identify all IBM WebSphere Application Server Liberty deployments with the adminCenter-1.0 administrative console feature enabled; disable this feature immediately for instances where it is not operationally required. Within 7 days: implement or strengthen network-layer egress filtering and segmentation to restrict outbound connections from Liberty instances to known-good internal destinations only; deploy monitoring to flag anomalous outbound HTTP/HTTPS traffic from affected systems. Within 30 days: subscribe to IBM PSIRT updates and commit to patching all affected versions (17.0.0.3 through 26.0.0.7) within 72 hours of vendor patch release.

IBM WebSphere Liberty CVE-2026-11546

EUVD-2026-40399 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-30 psirt@us.ibm.com

GHSA-7m34-7chv-8x87

SSRF IBM Websphere Application Server

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (us) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Network-reachable, unauthenticated SSRF (AV:N/AC:L/PR:N) with high confidentiality via internal-resource access but only limited integrity and no direct availability impact typical of SSRF.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (us).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:22 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 18:22 NVD

HIGH CRITICAL

CVSS changed

Jul 02, 2026 - 18:22 NVD

7.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jun 30, 2026 - 20:34 vuln.today

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.

AnalysisAI

Server-side request forgery in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers coerce the server into making arbitrary outbound requests when the adminCenter-1.0 feature is enabled. Reported by IBM PSIRT with a CVSS 3.1 base score of 9.8, the flaw carries no public exploit identified at time of analysis; EPSS is low at 0.21% (12th percentile) and CISA SSVC records exploitation status as none. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach exposed Admin Center endpoint

Delivery

Craft request with attacker-chosen URL

Exploit

Trigger SSRF in adminCenter-1.0 feature

Execution

Server issues forged outbound request

Impact

Pivot to internal services or metadata

Access

Reach exposed Admin Center endpoint

Delivery

Craft request with attacker-chosen URL

Exploit

Trigger SSRF in adminCenter-1.0 feature

Execution

Server issues forged outbound request

Impact

Pivot to internal services or metadata

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target Liberty server have the adminCenter-1.0 feature explicitly enabled in its configuration (server.xml) - this is the exact named prerequisite from the CVE description and is not enabled by default on a minimal Liberty server, so instances without Admin Center are not exploitable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals here conflict sharply and warrant caution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach an internet-exposed Liberty Admin Center sends a crafted request to the vulnerable adminCenter-1.0 handler, supplying a URL pointing at an internal-only resource such as a cloud metadata service or an internal management API. The server dutifully makes the outbound request and returns or acts on the response, letting the attacker enumerate and reach internal services from the trust position of the application server. …
Remediation	Apply the fix documented in IBM's advisory at https://www.ibm.com/support/pages/node/7278572; consult that page for the exact interim fix (iFix/APAR) or fixpack level, as no specific patched version is stated in the available intelligence - treat this as Patch available per vendor advisory rather than a confirmed version number. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: identify all IBM WebSphere Application Server Liberty deployments with the adminCenter-1.0 administrative console feature enabled; disable this feature immediately for instances where it is not operationally required. …

Threat intelligence, references, and detailed analysis are available after sign-in.