IBM WebSphere Liberty/Novalink Vuln Advisory: SSRF/RCE/DoS (CVE-2026-XXXX)

Vulnerability Overview IBM WebSphere Application (CVE-2026-50645, CVE-2026-9322, CVE-2026-11541, CVE-2026-4410, CVE-2026-9320, CVE-2026-8646, CVE-2026-11806, CVE-2026-9071, CVE-2026-11546, CVE-2026-5516) affects IBM PowerVM Novalink. Affected Versions IBM WebSphere Liberty Profile is used by IBM PowerVM Novalink. Affected versions: - PowerVM Novalink 2.2.0, 2.2.1, 2.2.1.1 - PowerVM Novalink 2.3.0, 2.3.0.1, 2.3.1, 2.3.2 Remediation IBM strongly recommends fixing the vulnerabilities by upgrading to the following versions: PowerVM Novalink 2.2.1.1 - Update to - Or update to PowerVM Novalink 2.3.3 - Update to Vulnerability Details 1. CVE-2026-50645 - Description: Apache CXF does not limit the number of attachment headers during deserialization, potentially leading to resource exhaustion or denial-of-service attacks. - Fix: Upgrade to version 4.2.2 or 4.1.7 to limit attachments to a maximum of 500 per message. 2. CVE-2026-9322 - Description: IBM WebSphere Application Server and Liberty are vulnerable to denial-of-service attacks caused by carefully crafted HTTP requests. 3. CVE-2026-9171 - Description: IBM WebSphere Application Server and Liberty are vulnerable to denial-of-service attacks caused by sending carefully crafted requests. 4. CVE-2026-11541 - Description: IBM WebSphere Application Server 9.0, 8.5, and Liberty 17.0.0.3 to 26.0.0.6 are vulnerable to HTTP request smuggling attacks. 5. CVE-2026-9320 - Description: IBM WebSphere Application Server 9.0, 8.5, and Liberty 17.0.0.3 to 26.0.0.6 are vulnerable to denial-of-service attacks caused by sending carefully crafted requests. 6. CVE-2026-8646 - Description: IBM WebSphere Application Server 9.0, 8.5, and Liberty 17.0.0.3 to 26.0.0.6 are vulnerable to HTTP request smuggling attacks. 7. CVE-2026-11806 - Description: IBM WebSphere Application Server - Liberty 17.0.0.3 to 26.0.0.6 are vulnerable to arbitrary file read issues related to the restConnector-2.0 feature. 8. CVE-2026-9071 - Description: IBM WebSphere Application Server 9.0, 8.5, and Liberty 17.0.0.3 to 26.0.0.6 are vulnerable to denial-of-service attacks caused by sending carefully crafted requests. 9. CVE-2026-11546 - Description: IBM WebSphere Application Server - Liberty 17.0.0.3 to 26.0.0.7 are vulnerable to server-side request forgery (SSRF) attacks when the adminCenter-1.0 feature is enabled. 10. CVE-2026-5516 - Description: IBM WebSphere Application Server - Liberty 22.0.0.11 to 26.0.0.5 are vulnerable to a flaw that allows bypassing security controls under limited conditions by exploiting a specific time window. 11. CVE-2026-4410 - Description: IBM WebSphere Application Server - Liberty 19.0.0.7 to 26.0.0.5 and WebSphere Application Server 9.0, 8.5 are vulnerable to denial-of-service attacks caused by sending carefully crafted requests. 12. CVE-2026-11714 - Description: IBM WebSphere Application Server - Liberty 17.0.0.3 to 26.0.0.7 are vulnerable to server-side request forgery (SSRF) attacks when the apiDiscovery-1.0 feature is enabled. Additional Information CVSS Score: The CVSS scores for the vulnerabilities range from 4.4 to 8.5. CVSS Vectors: CVSS vectors are provided for each vulnerability. Reference Links: Links to the complete CVSS v3 guide and an online calculator are provided. Related Resources: Links to the IBM Security Engineering Web Portal and the IBM Product Security Incident Response Blog are provided. Disclaimer IBM provides vulnerability scores "as is" and assumes no express or implied warranties. Customers are responsible for assessing the impact of vulnerabilities on their specific use cases. IBM regularly updates component records in its product portfolio and may identify previously unidentified packages. The affected products and versions refer exclusively to those supported by IBM.

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere Liberty/Novalink Vuln Advisory: SSRF/RCE/DoS (CVE-2026-XXXX)