What is the CVSS score of CVE-2026-11806?

CVE-2026-11806 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of IBM WebSphere Liberty are affected by CVE-2026-11806?

IBM WebSphere Application Server Liberty (versions 17.0.0.3-26.0.0.6) contains an arbitrary file read vulnerability affecting servers with the administrative REST connector feature enabled.

How to fix or mitigate CVE-2026-11806?

Within 24 hours: Identify all WebSphere Liberty instances running versions 17.0.0.3 through 26.0.0.6 and check which have the restConnector-2.0 feature enabled; disable the feature immediately if not operationally required. Within 7 days: Review access logs for suspicious file-read activity on administrative endpoints; assess inventory of sensitive files potentially exposed. Within 30 days: Monitor IBM security advisories for patch availability; schedule maintenance window and deploy patch to all affected instances upon release.

IBM WebSphere Liberty CVE-2026-11806

EUVD-2026-40394 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-06-30 psirt@us.ibm.com

GHSA-cxrq-p7xp-m9hw

Request Smuggling IBM Information Disclosure Websphere Application Server

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but request smuggling plus the required non-default restConnector-2.0 feature raise complexity to AC:H; impact is confidentiality-only (C:H, I:N, A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:17 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:15 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:07 vuln.today

cvss_changed

CVSS changed

Jul 02, 2026 - 18:07 NVD

7.2 (HIGH) 7.5 (HIGH)

Analysis Generated

Jun 30, 2026 - 20:35 vuln.today

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

AnalysisAI

Arbitrary file read in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.6) lets remote attackers retrieve files from the server host when the restConnector-2.0 administrative REST feature is enabled. The flaw is classed as HTTP request smuggling (CWE-444), meaning inconsistent request parsing lets an attacker coax the server into exposing file contents it should not serve. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach Liberty restConnector endpoint

Delivery

Send ambiguously-framed HTTP request

Exploit

Trigger request-smuggling parse mismatch

Execution

Coerce server to read target file

Impact

Exfiltrate disclosed file contents

Access

Reach Liberty restConnector endpoint

Delivery

Send ambiguously-framed HTTP request

Exploit

Trigger request-smuggling parse mismatch

Execution

Coerce server to read target file

Impact

Exfiltrate disclosed file contents

Vulnerability AssessmentAI

Exploitation	The restConnector-2.0 feature must be enabled in the Liberty configuration (server.xml) and its administrative HTTPS endpoint must be network-reachable by the attacker - this is the exact, concrete prerequisite named in the vendor description and is not the default posture for many deployments. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed and point to a moderate, not urgent, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach a Liberty server's administrative REST endpoint sends a crafted, ambiguously-framed HTTP request that the front-end and back-end parse differently, smuggling a request that causes the server to return the contents of a file it should not disclose (for example configuration or credential material). No public exploit identified at time of analysis, and the target must have restConnector-2.0 enabled and network-reachable, so exploitation is opportunistic rather than automated.
Remediation	Apply the fix described in IBM's advisory at https://www.ibm.com/support/pages/node/7277536; consult that page for the exact iFix or corrected fix pack, as no specific patched version string is present in the provided data - do not assume a version number. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all WebSphere Liberty instances running versions 17.0.0.3 through 26.0.0.6 and check which have the restConnector-2.0 feature enabled; disable the feature immediately if not operationally required. …

Threat intelligence, references, and detailed analysis are available after sign-in.