What is the CVSS score of CVE-2026-11806?

CVE-2026-11806 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-11806?

Within 24 hours: Identify all WebSphere Liberty instances running versions 17.0.0.3 through 26.0.0.6 and check which have the restConnector-2.0 feature enabled; disable the feature immediately if not operationally required. Within 7 days: Review access logs for suspicious file-read activity on administrative endpoints; assess inventory of sensitive files potentially exposed. Within 30 days: Monitor IBM security advisories for patch availability; schedule maintenance window and deploy patch to all affected instances upon release.

IBM WebSphere Liberty CVE-2026-11806

EUVD-2026-40394 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-06-30 psirt@us.ibm.com

GHSA-cxrq-p7xp-m9hw

Information Disclosure IBM Request Smuggling Websphere Application Server

7.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach Liberty restConnector endpoint
Delivery

Send ambiguously-framed HTTP request
Exploit

Trigger request-smuggling parse mismatch
Execution

Coerce server to read target file
Impact

Exfiltrate disclosed file contents

Vulnerability Assessment

Weakness	CWE CWE-444 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V4 - API and Web Service HTTP request consistency
Exploitation Conditions	The restConnector-2.0 feature must be enabled in the Liberty configuration (server.xml) and its administrative HTTPS endpoint must be network-reachable by the attacker - this is the exact, concrete prerequisite named in the vendor description and is not the default posture for many deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required once the feature is present, and impact is confidentiality-only (file read; no write or denial of service). Limiting factors that reduce realistic risk: instances without restConnector-2.0 are unaffected, versions outside 17.0.0.3-26.0.0.6 are unaffected, and Liberty admin connectors are frequently bound to internal management networks rather than the public internet.
Impact	Signals are mixed and point to a moderate, not urgent, priority. The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, unauthenticated, low-complexity issue with high confidentiality impact but no integrity or availability effect - SSVC likewise rates Technical Impact as 'total'. However, the exploitation-likelihood signals are low and mutually consistent: CISA SSVC lists Exploitation 'none' and Automatable 'no', EPSS is only 0.50% (39th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. A key caveat that tempers the raw score: the vector's PR:N/AC:L implies trivial default exploitation, yet the description explicitly requires the non-default restConnector-2.0 feature to be enabled - so real exposure is narrower than 7.5 suggests, and hosts without that feature are unaffected. Net: patch on a normal cycle, prioritizing internet-exposed Liberty instances that run the administrative REST connector.
Exploit ScenarioDerived	An attacker who can reach a Liberty server's administrative REST endpoint sends a crafted, ambiguously-framed HTTP request that the front-end and back-end parse differently, smuggling a request that causes the server to return the contents of a file it should not disclose (for example configuration or credential material). No public exploit identified at time of analysis, and the target must have restConnector-2.0 enabled and network-reachable, so exploitation is opportunistic rather than automated.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 02, 2026

Arbitrary file read in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.6) lets remote attackers retrieve files from the server host when the restConnector-2.0 administrative REST feature is enabled. The flaw is classed as HTTP request smuggling (CWE-444), meaning inconsistent request parsing lets an attacker coax the server into exposing file contents it should not serve. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is low at 0.50% (39th percentile).

Earlier versions of this analysis (2)

v2 Jul 02, 2026 - 18:15 cvss changed CVSS 7.5

Arbitrary file read in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.6) allows remote attackers to retrieve the contents of arbitrary files from the server filesystem when the restConnector-2.0 administrative feature is enabled. The flaw is classified as an HTTP request/response smuggling issue (CWE-444) that yields full confidentiality impact, and no public exploit has been identified at time of analysis. EPSS estimates a low 0.50% exploitation probability and CISA's SSVC framework records no observed exploitation, though it rates the technical impact as total.

v1 Jun 30, 2026 - 20:35 CVSS 7.2

Arbitrary file read in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6 allows an authenticated, high-privileged remote attacker to read arbitrary files on the host when the restConnector-2.0 administrative feature is enabled. The flaw is classified as HTTP request smuggling (CWE-444) and tagged as information disclosure, indicating inconsistent HTTP request interpretation against the JMX REST connector. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.

RemediationAI

Apply the fix described in IBM's advisory at https://www.ibm.com/support/pages/node/7277536; consult that page for the exact iFix or corrected fix pack, as no specific patched version string is present in the provided data - do not assume a version number. As a targeted compensating control where patching is delayed, disable the restConnector-2.0 feature in server.xml if remote administrative REST/JMX access is not required, which fully removes the attack surface but also disables remote management and monitoring of that Liberty instance. If the feature must stay enabled, restrict network access to the administrative connector port to trusted management hosts via firewall or reverse-proxy allow-listing, and ensure any fronting proxy normalizes HTTP requests consistently to reduce request-smuggling opportunities; the trade-off is added network-management overhead and no guarantee of complete mitigation. Reference: EUVD-2026-40394.

Affected VersionsENISA

WebSphere Application Server - Liberty 17.0.0.3 ≤26.0.0.6

Affected Packages

euvd websphere_application_server_liberty no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

WebSphere Liberty is IBM's lightweight, modular Java EE / Jakarta EE application server whose capabilities are toggled via named features. The affected component is the restConnector-2.0 feature, which exposes an administrative REST/JMX endpoint over HTTPS used for remote management and monitoring of the Liberty runtime. The root-cause class is CWE-444 (Inconsistent Interpretation of HTTP Requests, i.e. request smuggling): when front-end and back-end HTTP parsers disagree on message boundaries, an attacker can smuggle a request or manipulate path handling to read files outside the intended scope. The CPE cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:* confirms the Liberty edition (not traditional full-profile WAS) is affected, and the vendor-supplied tags ('Information Disclosure', 'Request Smuggling') corroborate an information-disclosure impact delivered through smuggling rather than direct path traversal.

Know when Websphere Application Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 5.9 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but request smuggling plus the required non-default restConnector-2.0 feature raise complexity to AC:H; impact is confidentiality-only (C:H, I:N, A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:17 vuln.today

v3 - CVSS changed

Analysis Updated

Jul 02, 2026 - 18:15 vuln.today

v2 - CVSS changed

CVSS changed

Jul 02, 2026 - 18:07 NVD

7.2 (HIGH) 7.5 (HIGH)

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

Executive ViewAI

Why It Matters

IBM WebSphere Application Server Liberty (versions 17.0.0.3-26.0.0.6) contains an arbitrary file read vulnerability affecting servers with the administrative REST connector feature enabled. Exploitation could expose sensitive data including configuration files, credentials, and application data on vulnerable servers.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable restConnector-2.0 feature if operationally feasible; (2) Restrict network access to administrative REST endpoints via firewall rules and IP whitelisting; (3) Monitor and alert on unusual file-read patterns to administrative endpoints; (4) Maintain detailed access logs for forensic review if compromise is suspected.

Threat Intelligence Overview

EPSS Score

0.5%

Top 61% exploitable

Prevalence

High

widely deployed enterprise Java application server across large organizations

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

HTTP Request Smuggling HIGH

HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.