What is the CVSS score of CVE-2026-11595?

CVE-2026-11595 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere Application Server are affected by CVE-2026-11595?

IBM WebSphere Application Server versions 8.5 and 9.0 contain a path traversal vulnerability in the administrative console that permits remote, unauthenticated attackers to read sensitive files…

How to fix or mitigate CVE-2026-11595?

Within 24 hours: Identify and inventory all WAS 8.5 and 9.0 instances; restrict administrative console network access to internal-trusted networks only using firewall or load-balancer rules. Within 7 days: Review administrative console access logs for path traversal indicators and suspicious help-system endpoint requests; conduct a configuration audit to identify sensitive data stored in WAS (credentials, database connection strings, API keys). Within 30 days: Monitor IBM security advisories for patch availability and prepare upgrade testing plan; implement interim controls including disabling the help system module (if operationally feasible) or deploying WAF rules to block path traversal patterns.

IBM WebSphere Application Server CVE-2026-11595

EUVD-2026-40398 HIGH

Path Traversal (CWE-22)

2026-06-30 psirt@us.ibm.com

GHSA-4qvc-jg4j-cv44

IBM Path Traversal Websphere Application Server

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote read via a console help endpoint (AV:N/AC:L/PR:N/UI:N) causing file disclosure only, so C:H with I:N/A:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:22 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 18:22 NVD

MEDIUM HIGH

CVSS changed

Jul 02, 2026 - 18:22 NVD

4.3 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Jun 30, 2026 - 20:37 vuln.today

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.

AnalysisAI

Directory traversal (CWE-22) in the administrative console's integrated help system of IBM WebSphere Application Server (traditional) 8.5 and 9.0 lets remote attackers read sensitive files outside the intended help-content directory, disclosing confidential information. CVSS 7.5 reflects unauthenticated network reach with high confidentiality impact but no integrity or availability effect. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach admin console over network

Delivery

Request help system with traversal payload

Exploit

Escape help content directory

Execution

Read arbitrary server-readable file

Impact

Exfiltrate sensitive information

Access

Reach admin console over network

Delivery

Request help system with traversal payload

Exploit

Escape help content directory

Execution

Read arbitrary server-readable file

Impact

Exfiltrate sensitive information

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the WebSphere Application Server administrative (ISC) console and specifically its integrated help system endpoint on an affected traditional build (9.0 or 8.5). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are internally consistent and point to a real but non-urgent priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach the WebSphere administrative console over the network sends a crafted request to the integrated help system containing directory-traversal sequences, causing the server to return the contents of a file outside the help-content directory (for example a configuration or credential-bearing file readable by the server process). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required once the endpoint is reachable; no public proof-of-concept has been identified at time of analysis.
Remediation	Apply the fix from IBM's official advisory at https://www.ibm.com/support/pages/node/7278590, which for WebSphere traditional is typically delivered as an interim fix (APAR/PTF) or a cumulative Fix Pack for the 8.5.5.x and 9.0.5.x streams; the specific patched Fix Pack/iFix identifier is provided in that advisory and should be applied per your maintenance stream, as no exact fix version is given in the source data here. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify and inventory all WAS 8.5 and 9.0 instances; restrict administrative console network access to internal-trusted networks only using firewall or load-balancer rules. …

Threat intelligence, references, and detailed analysis are available after sign-in.