What is the CVSS score of CVE-2026-11595?

CVE-2026-11595 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere Application Server are affected by CVE-2026-11595?

IBM WebSphere Application Server versions 8.5 and 9.0 contain a path traversal vulnerability in the administrative console that permits remote, unauthenticated attackers to read sensitive files…

How to fix or mitigate CVE-2026-11595?

Within 24 hours: Identify and inventory all WAS 8.5 and 9.0 instances; restrict administrative console network access to internal-trusted networks only using firewall or load-balancer rules. Within 7 days: Review administrative console access logs for path traversal indicators and suspicious help-system endpoint requests; conduct a configuration audit to identify sensitive data stored in WAS (credentials, database connection strings, API keys). Within 30 days: Monitor IBM security advisories for patch availability and prepare upgrade testing plan; implement interim controls including disabling the help system module (if operationally feasible) or deploying WAF rules to block path traversal patterns.

IBM WebSphere Application Server CVE-2026-11595

EUVD-2026-40398 HIGH

Path Traversal (CWE-22)

2026-06-30 psirt@us.ibm.com

GHSA-4qvc-jg4j-cv44

IBM Path Traversal Websphere Application Server

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote read via a console help endpoint (AV:N/AC:L/PR:N/UI:N) causing file disclosure only, so C:H with I:N/A:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:22 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 18:22 NVD

MEDIUM HIGH

CVSS changed

Jul 02, 2026 - 18:22 NVD

4.3 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Jun 30, 2026 - 20:37 vuln.today

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.

AnalysisAI

Directory traversal (CWE-22) in the administrative console's integrated help system of IBM WebSphere Application Server (traditional) 8.5 and 9.0 lets remote attackers read sensitive files outside the intended help-content directory, disclosing confidential information. CVSS 7.5 reflects unauthenticated network reach with high confidentiality impact but no integrity or availability effect. There is no public exploit identified at time of analysis, and the low EPSS score (0.27%, 19th percentile) plus SSVC 'Exploitation: none' indicate no observed exploitation to date.

Technical ContextAI

WebSphere Application Server traditional is IBM's Java EE application server; the affected component is the browser-based administrative (ISC) console, specifically its bundled help system that serves documentation content to console users. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the help subsystem constructs a filesystem path from client-supplied input without adequately canonicalizing or constraining it, so traversal sequences (e.g. '../') can escape the intended help-content root and reference arbitrary files the server process can read. The CPE data (cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:*) scopes this to the 'traditional' edition rather than WebSphere Liberty.

RemediationAI

Apply the fix from IBM's official advisory at https://www.ibm.com/support/pages/node/7278590, which for WebSphere traditional is typically delivered as an interim fix (APAR/PTF) or a cumulative Fix Pack for the 8.5.5.x and 9.0.5.x streams; the specific patched Fix Pack/iFix identifier is provided in that advisory and should be applied per your maintenance stream, as no exact fix version is given in the source data here. As a compensating control until patched, restrict network access to the administrative console so it is only reachable from trusted management networks or over VPN/bastion (the console is not intended for untrusted exposure) - the trade-off is only that administrators must route through the restricted path; additionally place the console behind a reverse proxy or WAF rule that blocks path-traversal patterns ('../', encoded variants) on help-system URLs, accepting the risk that filter bypasses are possible and this is not a substitute for the vendor fix.