What is the CVSS score of CVE-2026-11714?

CVE-2026-11714 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM WebSphere Liberty are affected by CVE-2026-11714?

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 contain a critical server-side request forgery vulnerability allowing unauthenticated remote attackers to manipulate the…

How to fix or mitigate CVE-2026-11714?

24 hours: Audit all IBM WebSphere Application Server Liberty instances for versions 17.0.0.3-26.0.0.7; identify deployments with apiDiscovery-1.0 feature enabled and network accessibility. 7 days: Disable apiDiscovery-1.0 feature on all affected systems, or implement firewall rules restricting outbound connections from Liberty servers to internal resources. 30 days: Monitor IBM vendor security advisories for patch release to version 26.0.0.8 or later; if unavailable within 60 days, execute application server migration plan to alternative platforms.

IBM WebSphere Liberty CVE-2026-11714

EUVD-2026-40395 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-30 psirt@us.ibm.com

GHSA-2pmg-8j9g-3c72

SSRF IBM Websphere Application Server

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.2 CRITICAL

Unauthenticated network SSRF (AV:N/PR:N/UI:N) enables high confidentiality via internal reads and metadata theft; integrity is low and availability negligible, unlike the vendor's C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:15 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:07 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 18:07 NVD

HIGH CRITICAL

CVSS changed

Jul 02, 2026 - 18:07 NVD

8.5 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jun 30, 2026 - 20:35 vuln.today

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.

AnalysisAI

Server-side request forgery in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote, unauthenticated attackers coerce the server into issuing crafted requests to internal or external systems when the optional apiDiscovery-1.0 feature is enabled. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), reflecting network-reachable, no-privilege exploitation, though no public exploit is identified at time of analysis and EPSS is low at 0.19% (8th percentile). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify Liberty host with apiDiscovery-1.0 enabled

Delivery

Send crafted unauthenticated request naming internal target

Exploit

Server issues attacker-controlled outbound request (SSRF)

Execution

Reach internal service or cloud metadata endpoint

Impact

Exfiltrate data or pivot into internal network

Access

Identify Liberty host with apiDiscovery-1.0 enabled

Delivery

Send crafted unauthenticated request naming internal target

Exploit

Server issues attacker-controlled outbound request (SSRF)

Execution

Reach internal service or cloud metadata endpoint

Impact

Exfiltrate data or pivot into internal network

Vulnerability AssessmentAI

Exploitation	The decisive prerequisite is that the apiDiscovery-1.0 feature is explicitly enabled in the Liberty server configuration (featureManager in server.xml); this feature is not part of a default Liberty server, so servers without it are not exploitable regardless of version. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals conflict and should be weighed together rather than acting on the 9.8 alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An external attacker identifies an internet-reachable Liberty server with apiDiscovery-1.0 enabled and submits a crafted request that causes the server to fetch an attacker-specified URL. The server issues that request from inside the network, letting the attacker probe internal-only services or retrieve cloud instance metadata credentials. …
Remediation	Apply the fix from the IBM advisory at https://www.ibm.com/support/pages/node/7278580 (Patch available per vendor advisory; an exact fixed fix-pack version is not stated in the available data, so confirm the interim fix or fix pack level directly with IBM for your release). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

24 hours: Audit all IBM WebSphere Application Server Liberty instances for versions 17.0.0.3-26.0.0.7; identify deployments with apiDiscovery-1.0 feature enabled and network accessibility. …

Threat intelligence, references, and detailed analysis are available after sign-in.