What is the CVSS score of CVE-2026-11546?

CVE-2026-11546 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM WebSphere Liberty are affected by CVE-2026-11546?

IBM WebSphere Application Server Liberty (versions 17.0.0.3-26.0.0.7) contains a critical server-side request forgery flaw that allows remote attackers to make arbitrary outbound requests when the…

How to fix or mitigate CVE-2026-11546?

Within 24 hours: identify all IBM WebSphere Application Server Liberty deployments with the adminCenter-1.0 administrative console feature enabled; disable this feature immediately for instances where it is not operationally required. Within 7 days: implement or strengthen network-layer egress filtering and segmentation to restrict outbound connections from Liberty instances to known-good internal destinations only; deploy monitoring to flag anomalous outbound HTTP/HTTPS traffic from affected systems. Within 30 days: subscribe to IBM PSIRT updates and commit to patching all affected versions (17.0.0.3 through 26.0.0.7) within 72 hours of vendor patch release.

IBM WebSphere Liberty CVE-2026-11546

EUVD-2026-40399 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-30 psirt@us.ibm.com

GHSA-7m34-7chv-8x87

SSRF IBM Websphere Application Server

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (us) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Network-reachable, unauthenticated SSRF (AV:N/AC:L/PR:N) with high confidentiality via internal-resource access but only limited integrity and no direct availability impact typical of SSRF.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (us).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:22 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 18:22 NVD

HIGH CRITICAL

CVSS changed

Jul 02, 2026 - 18:22 NVD

7.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jun 30, 2026 - 20:34 vuln.today

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.

AnalysisAI

Server-side request forgery in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers coerce the server into making arbitrary outbound requests when the adminCenter-1.0 feature is enabled. Reported by IBM PSIRT with a CVSS 3.1 base score of 9.8, the flaw carries no public exploit identified at time of analysis; EPSS is low at 0.21% (12th percentile) and CISA SSVC records exploitation status as none. The adminCenter-1.0 administrative console feature is the specific attack surface, so exposure is limited to Liberty instances that enable it.

Technical ContextAI

WebSphere Liberty is IBM's lightweight, modular Java application server profile, where capabilities are activated as named features in server.xml. The vulnerable component is the adminCenter-1.0 feature, which provides the browser-based Admin Center management console. The root cause is CWE-918 (Server-Side Request Forgery): a server-side handler within Admin Center accepts attacker-influenced input that determines the destination of an outbound request, without adequately validating or restricting the target, allowing the server to be used as a proxy to reach internal or otherwise unreachable network endpoints. The affected CPE is cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:*, scoping the issue specifically to the Liberty profile rather than the traditional WebSphere Application Server profile.

RemediationAI

Apply the fix documented in IBM's advisory at https://www.ibm.com/support/pages/node/7278572; consult that page for the exact interim fix (iFix/APAR) or fixpack level, as no specific patched version is stated in the available intelligence - treat this as Patch available per vendor advisory rather than a confirmed version number. As the primary compensating control until patched, disable the adminCenter-1.0 feature in server.xml on any instance that does not require the browser-based Admin Center, which removes the vulnerable attack surface entirely at the cost of losing web-console management (CLI and configuration-file management remain available). Where Admin Center must stay enabled, restrict network access to its port so it is reachable only from a trusted management subnet or via VPN/jump host, and place it behind a reverse proxy or firewall rule that blocks direct internet exposure; additionally constrain the Liberty host's outbound egress so the server cannot reach internal metadata endpoints or sensitive internal services, limiting the blast radius of any SSRF. These network controls reduce but do not eliminate risk from a trusted-network attacker, so patching remains the durable fix.