What is the CVSS score of CVE-2026-11806?

CVE-2026-11806 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of IBM WebSphere Liberty are affected by CVE-2026-11806?

IBM WebSphere Application Server Liberty (versions 17.0.0.3-26.0.0.6) contains an arbitrary file read vulnerability affecting servers with the administrative REST connector feature enabled.

How to fix or mitigate CVE-2026-11806?

Within 24 hours: Identify all WebSphere Liberty instances running versions 17.0.0.3 through 26.0.0.6 and check which have the restConnector-2.0 feature enabled; disable the feature immediately if not operationally required. Within 7 days: Review access logs for suspicious file-read activity on administrative endpoints; assess inventory of sensitive files potentially exposed. Within 30 days: Monitor IBM security advisories for patch availability; schedule maintenance window and deploy patch to all affected instances upon release.

IBM WebSphere Liberty CVE-2026-11806

EUVD-2026-40394 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-06-30 psirt@us.ibm.com

GHSA-cxrq-p7xp-m9hw

Request Smuggling IBM Information Disclosure Websphere Application Server

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but request smuggling plus the required non-default restConnector-2.0 feature raise complexity to AC:H; impact is confidentiality-only (C:H, I:N, A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:17 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:15 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:07 vuln.today

cvss_changed

CVSS changed

Jul 02, 2026 - 18:07 NVD

7.2 (HIGH) 7.5 (HIGH)

Analysis Generated

Jun 30, 2026 - 20:35 vuln.today

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

AnalysisAI

Arbitrary file read in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.6) lets remote attackers retrieve files from the server host when the restConnector-2.0 administrative REST feature is enabled. The flaw is classed as HTTP request smuggling (CWE-444), meaning inconsistent request parsing lets an attacker coax the server into exposing file contents it should not serve. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is low at 0.50% (39th percentile).

Technical ContextAI

WebSphere Liberty is IBM's lightweight, modular Java EE / Jakarta EE application server whose capabilities are toggled via named features. The affected component is the restConnector-2.0 feature, which exposes an administrative REST/JMX endpoint over HTTPS used for remote management and monitoring of the Liberty runtime. The root-cause class is CWE-444 (Inconsistent Interpretation of HTTP Requests, i.e. request smuggling): when front-end and back-end HTTP parsers disagree on message boundaries, an attacker can smuggle a request or manipulate path handling to read files outside the intended scope. The CPE cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:* confirms the Liberty edition (not traditional full-profile WAS) is affected, and the vendor-supplied tags ('Information Disclosure', 'Request Smuggling') corroborate an information-disclosure impact delivered through smuggling rather than direct path traversal.

RemediationAI

Apply the fix described in IBM's advisory at https://www.ibm.com/support/pages/node/7277536; consult that page for the exact iFix or corrected fix pack, as no specific patched version string is present in the provided data - do not assume a version number. As a targeted compensating control where patching is delayed, disable the restConnector-2.0 feature in server.xml if remote administrative REST/JMX access is not required, which fully removes the attack surface but also disables remote management and monitoring of that Liberty instance. If the feature must stay enabled, restrict network access to the administrative connector port to trusted management hosts via firewall or reverse-proxy allow-listing, and ensure any fronting proxy normalizes HTTP requests consistently to reduce request-smuggling opportunities; the trade-off is added network-management overhead and no guarantee of complete mitigation. Reference: EUVD-2026-40394.