CVE Intelligence
Analysis AI-assisted

CVE-2026-11546: IBM WebSphere Application Server Liberty SSRF

IBM has disclosed a server-side request forgery (SSRF) vulnerability in WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 when the adminCenter-1.0 feature is enabled. NVD scores it 9.8 (critical) under CVSS 3.1, while the IBM PSIRT score in the record is 7.1. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-11546 is a server-side request forgery (SSRF, CWE-918) affecting IBM WebSphere Application Server Liberty. The record places the issue in versions from 17.0.0.3 through 26.0.0.7 when the adminCenter-1.0 feature is enabled.

Impact

  • SSRF can cause a server to make requests to destinations chosen by a remote party, which may expose internal services or metadata.
  • NVD rates the base vector as network-reachable, low complexity, no privileges and no user interaction, with high confidence, integrity and availability impact (CVSS 3.1 score 9.8).
  • The IBM PSIRT score in the record is 7.1. The difference between scorers should be reviewed in the vendor advisory.

Affected products and versions

  • IBM WebSphere Application Server Liberty, versions 17.0.0.3 through 26.0.0.7 according to the description, with the adminCenter-1.0 feature enabled.
  • The record expresses the affected range as 17.0.0.3 or later and before 26.0.0.8.
  • No fixed version is listed in the record. Consult the IBM advisory to confirm the remediation level for your version line.

Exploitation status

  • The record does not list this vulnerability in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Check whether the adminCenter-1.0 feature is enabled on Liberty servers in your inventory, and disable it where it is not needed to reduce exposure.
  • Review the IBM security advisory and apply the vendor-provided fix or update for your version line.
  • Restrict network access to administrative interfaces and limit outbound connections from application servers where feasible.

Detection guidance

  • Inventory Liberty installations and their feature configurations, including whether adminCenter-1.0 is active.
  • Monitor for unexpected outbound requests from application servers, especially to internal address ranges or cloud metadata endpoints.
  • Review administrative interface access logs for unusual request patterns.

Limitations of the available information

  • The record does not include fixed versions, technical details of the flaw, or the exact conditions under which the SSRF is reachable.
  • The EPSS values are probabilistic estimates, and the EPSS date in the record (2026-10-13) should be verified against the current feed.
  • Scores differ between providers, and the record does not explain the difference.

Frequently asked questions

Is CVE-2026-11546 being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. Monitoring should continue because the status can change.

Which Liberty versions are affected?

The description states versions 17.0.0.3 through 26.0.0.7 with the adminCenter-1.0 feature enabled. The record lists no fixed version, so the IBM advisory should be consulted for remediation levels.

What should administrators do first?

Identify Liberty servers with adminCenter-1.0 enabled, check them against the IBM advisory, and disable the feature where it is not required while planning updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.