IBM WebSphere Application Server CVE-2026-11595

Exploitation requires network reachability to the WebSphere Application Server administrative (ISC) console and specifically its integrated help system endpoint on an affected traditional build (9.0 or 8.5). Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, so the practical limiting factor is exposure of the admin console: in deployments where the console is bound only to a management interface or firewalled off, an untrusted attacker cannot reach the vulnerable endpoint. Impact is limited to reading files accessible to the server process (C:H, I:N, A:N) - it does not allow modification or code execution. WebSphere Liberty is not indicated as affected.

Signals are internally consistent and point to a real but non-urgent priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N) supports unauthenticated, low-complexity remote access with high confidentiality impact (C:H, I:N, A:N), which is why the base score is 7.5. However, EPSS is low (0.27%, 19th percentile) and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: partial - collectively arguing against active or scalable exploitation. One caveat to verify: PR:N implies the vulnerable help endpoint is reachable without authentication, yet the feature lives inside the administrative console, which is normally access-restricted; if in a given deployment the console is not exposed to untrusted networks, real-world reachability (and thus risk) is materially lower than the raw 7.5 suggests. Net: patch on a normal cycle, prioritize where the admin console is network-exposed.

An attacker who can reach the WebSphere administrative console over the network sends a crafted request to the integrated help system containing directory-traversal sequences, causing the server to return the contents of a file outside the help-content directory (for example a configuration or credential-bearing file readable by the server process). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required once the endpoint is reachable; no public proof-of-concept has been identified at time of analysis.