What is the CVSS score of CVE-2026-11549?

CVE-2026-11549 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-11549?

Yes, a patch is available for CVE-2026-11549. Update the affected software to the latest version immediately.

IBM WebSphere CVE-2026-11549

EUVD-2026-83286 MEDIUM

Improper Access Control (CWE-284)

2026-09-18 ibm

GHSA-c3g2-rhrj-675h

Authentication Bypass IBM Cics Tx Advanced

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

Remote unauthenticated (AV:N/PR:N) with bounded cross-vhost read/write impact (C:L/I:L, A:N); AC:H because it depends on a specific multi-virtual-host configuration to be exploitable.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 18, 2026 - 20:05 vuln.today

DescriptionNVD

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability.

AnalysisAI

Virtual host isolation bypass in IBM WebSphere Application Server and WebSphere Application Server Liberty, as bundled in IBM CICS TX Advanced 10.1, allows remote requests addressed to one configured virtual host to reach resources belonging to another virtual host on the same instance. The vendor assigns CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-284); our independent assessment keeps the same unauthenticated, low-confidentiality/low-integrity, no-availability profile but raises attack complexity to AC:H because the weakness is only meaningful when an instance is configured to serve multiple distinct virtual hosts, while a default single-virtual-host deployment offers little to bypass. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires a Liberty/WebSphere Application Server instance (as bundled in IBM CICS TX Advanced 10.1) that is configured to serve multiple virtual hosts, since the flaw is the failure to enforce isolation between those virtual hosts; a single-vhost or default deployment offers little to bypass. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a medium-severity access-control (virtual host bypass) flaw with a coherent vendor CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch available per vendor advisory: apply the fix referenced in IBM's support bulletin at https://www.ibm.com/support/pages/node/7287740 for IBM WebSphere Application Server / WebSphere Application Server Liberty, including the IBM CICS TX Advanced 10.1 distribution that bundles the Liberty runtime (no independent fix version number is stated in the available data, so confirm the exact fix pack level on that page before deployment). … Detailed patch versions, workarounds, and compensating controls in full report.