CVE Intelligence
Analysis AI-assisted

CVE-2026-11714: IBM WebSphere Application Server Liberty: SSRF in apiDiscovery-1.0

IBM WebSphere Application Server Liberty contains a server-side request forgery flaw when the apiDiscovery-1.0 feature is enabled. NVD rates it critical with a CVSS 3.1 base score of 9.8, while IBM PSIRT lists 8.5. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

IBM has published a security bulletin for WebSphere Application Server Liberty describing a server-side request forgery (SSRF) weakness classified as CWE-918. According to the record, the issue applies when the apiDiscovery-1.0 feature is enabled. The IBM security bulletin is the vendor reference listed for this CVE.

Impact

  • NVD rates the issue as critical with a CVSS 3.1 base score of 9.8. The vector describes a network-reachable attack with no privileges or user interaction, and high confidentiality, integrity and availability impact.
  • IBM PSIRT lists a different CVSS 3.1 score of 8.5 in the record.
  • SSRF generally allows a server to be induced to send requests to unintended destinations. The record does not describe the specific consequences for this product.

Affected products and versions

  • IBM WebSphere Application Server Liberty, versions from 17.0.0.3 up to but not including 26.0.0.8, according to the record.
  • The relevant condition is the apiDiscovery-1.0 feature being enabled.

Exploitation status

  • The CVE is not listed in the CISA KEV catalog in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The record reports an EPSS probability of 0.00365 with a percentile of 0.28534.

Remediation and mitigation

  • The record contains no fixed version list. Consult the IBM bulletin for fix levels and apply vendor-provided updates to affected Liberty installations.
  • If the apiDiscovery-1.0 feature is not required, consider disabling it as a defensive measure until patches are applied, after confirming the impact with IBM guidance.
  • Limit outbound connections from application servers where feasible, for example through egress filtering and network segmentation.

Detection guidance

  • Inventory Liberty servers and verify whether apiDiscovery-1.0 is enabled in their server configuration.
  • Review logs and network telemetry for unexpected outbound connections originating from application servers, especially toward internal address ranges or cloud metadata services.
  • Monitor for requests that carry external or internal URLs in parameters processed by the server, and alert on anomalies.

Limitations of the available information

  • The record does not include a fixed version list, a detailed technical description beyond the summary, or the text of the IBM advisory.
  • NVD and IBM PSIRT assign different CVSS 3.1 scores, and the record does not explain the difference.
  • The record did not include a title, so the title in this analysis is derived from the description.

Frequently asked questions

Is CVE-2026-11714 being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. Monitor official sources for changes.

Does the vulnerability affect every WebSphere Liberty installation?

According to the record, the issue applies to versions from 17.0.0.3 up to but not including 26.0.0.8 when the apiDiscovery-1.0 feature is enabled.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.