IBM WebSphere Application Server Liberty Arbitrary File Read Vulnerability (CVE-2026-11806)

IBM WebSphere Application Server Liberty Arbitrary File Read Vulnerability (CVE-2026-11806) Vulnerability Overview CVE ID: CVE-2026-11806 Description: IBM WebSphere Application Server Liberty has an arbitrary file read vulnerability when using the feature. CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVSS Source: IBM CVSS Base Score: 7.2 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Affected Products Affected Product: IBM WebSphere Application Server - Liberty Affected Versions: 17.0.0.3 - 26.0.0.6 Remediation Recommendation: IBM strongly recommends immediately resolving this vulnerability by applying the currently available interim fix or a fix pack that includes the fix. Interim Fix: For IBM WebSphere Application Server Liberty versions 17.0.0.3 - 26.0.0.6 using the feature: - Upgrade to the required interim fix level, then apply the interim fix addressing PH71719. - Alternatively, apply Liberty Fix Pack 26.0.0.7 or later (Target Availability Q2 2026). Other Fixes: There may be other interim fixes available; links to the interim fix download page are provided. Workarounds and Mitigations None References Complete CVSS v3 Guide Online Calculator v3 Related Information IBM Security Engineering Web Portal IBM Product Security Incident Response Blog Acknowledgments June 23, 2026: Initial release Disclaimer The Common Vulnerability Scoring System (CVSS) is an industry open standard, as defined by the Forum of Incident Response and Security Teams (FIRST), intended to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is" without any expressed or implied warranties, including the implied warranties of merchantability and fitness for a particular purpose. Customers are responsible for assessing the impact of any actual or potential security vulnerabilities. IBM regularly updates vulnerability records within its product components. Furthermore, in response to potential vulnerabilities, IBM identifies previously unreported packages regardless of the CVE date. The inclusion of an older CVE ID does not prove that IBM used the referenced product since that date, nor does it prove that IBM was aware of the vulnerability on that date. We strive to make customers aware of relevant vulnerabilities because we understand them. The "Affected Products and Versions" referenced in the IBM Security Bulletin refer only to supported, non-end-of-life IBM product and service versions. Therefore, the failure to reference supported or extended support product and versions in this security bulletin does not constitute a determination by IBM that those versions are unaffected by the vulnerability. Referencing one or more unsupported versions in this security bulletin does not impose any obligation on IBM to provide fixes for any unsupported or extended support product or version.

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere Application Server Liberty Arbitrary File Read Vulnerability (CVE-2026-11806)

More from this source