What is the CVSS score of CVE-2026-11714?

CVE-2026-11714 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM WebSphere Liberty are affected by CVE-2026-11714?

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 contain a critical server-side request forgery vulnerability allowing unauthenticated remote attackers to manipulate the…

How to fix or mitigate CVE-2026-11714?

24 hours: Audit all IBM WebSphere Application Server Liberty instances for versions 17.0.0.3-26.0.0.7; identify deployments with apiDiscovery-1.0 feature enabled and network accessibility. 7 days: Disable apiDiscovery-1.0 feature on all affected systems, or implement firewall rules restricting outbound connections from Liberty servers to internal resources. 30 days: Monitor IBM vendor security advisories for patch release to version 26.0.0.8 or later; if unavailable within 60 days, execute application server migration plan to alternative platforms.

IBM WebSphere Liberty CVE-2026-11714

EUVD-2026-40395 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-30 psirt@us.ibm.com

GHSA-2pmg-8j9g-3c72

SSRF IBM Websphere Application Server

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.2 CRITICAL

Unauthenticated network SSRF (AV:N/PR:N/UI:N) enables high confidentiality via internal reads and metadata theft; integrity is low and availability negligible, unlike the vendor's C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:15 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:07 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 18:07 NVD

HIGH CRITICAL

CVSS changed

Jul 02, 2026 - 18:07 NVD

8.5 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jun 30, 2026 - 20:35 vuln.today

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.

AnalysisAI

Server-side request forgery in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote, unauthenticated attackers coerce the server into issuing crafted requests to internal or external systems when the optional apiDiscovery-1.0 feature is enabled. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), reflecting network-reachable, no-privilege exploitation, though no public exploit is identified at time of analysis and EPSS is low at 0.19% (8th percentile). CISA SSVC scores exploitation as none and non-automatable, indicating no observed weaponization yet.

Technical ContextAI

The affected component is Open Liberty / WebSphere Liberty's apiDiscovery-1.0 feature, which aggregates and exposes Swagger/OpenAPI documentation for deployed applications and can fetch remote API definition documents. CWE-918 (SSRF) is the root cause: the feature accepts or dereferences a URL/endpoint and the server performs the outbound request without adequately validating or restricting the destination, allowing an attacker-controlled target. Because Liberty runs as the application server process, such requests originate from inside the trust boundary and can reach loopback services, cloud instance metadata endpoints, and other hosts otherwise unreachable from outside. The single affected CPE is cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:* covering the Liberty profile specifically, not traditional WebSphere Application Server ND.

RemediationAI

Apply the fix from the IBM advisory at https://www.ibm.com/support/pages/node/7278580 (Patch available per vendor advisory; an exact fixed fix-pack version is not stated in the available data, so confirm the interim fix or fix pack level directly with IBM for your release). As an immediate compensating control, disable the apiDiscovery-1.0 feature by removing it from the <featureManager> element in server.xml where it is not required - this fully removes the attack surface but also disables the aggregated Swagger/OpenAPI discovery endpoint for that server, breaking any tooling that relies on it. Where the feature must stay enabled, restrict network access to the apiDiscovery endpoints via a reverse proxy or firewall rules and add egress filtering so the Liberty host cannot reach internal management interfaces, loopback-only services, or cloud metadata endpoints (e.g., 169.254.169.254); egress filtering can interfere with legitimate outbound integrations, so scope allow-lists carefully. Verify remediation across all instances in the 17.0.0.3-26.0.0.7 range.