CVE-2026-11547: IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

Q: Which Liberty versions are affected?

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected. Versions prior to 17.0.0.3 are not identified in the provided information.

Q: What access does an attacker need to exploit this issue?

The severity vector indicates network reachability, low attack complexity, no user interaction, and low privileges required. An attacker must have low-level privileges to target the Admin Center deploy validation endpoint.

Q: What impact does successful exploitation have?

The issue is a server-side request forgery in the Admin Center deploy validation endpoint. The provided vector indicates low confidentiality impact and no integrity or availability impact.

Published Nov 3, 2026

Updated

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint.

Other sources

IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint.

— IBM

Affected Software

1 affected component

IBM WebSphere Application Server - Liberty<=17.0.0.3 - 26.0.0.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM WebSphere Application Server Liberty to a version that resolves this vulnerability.
Fixed in 26.0.0.11

Event History

Nov 3, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295268

Frequently Asked Questions

Which Liberty versions are affected?

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected. Versions prior to 17.0.0.3 are not identified in the provided information.

What access does an attacker need to exploit this issue?

The severity vector indicates network reachability, low attack complexity, no user interaction, and low privileges required. An attacker must have low-level privileges to target the Admin Center deploy validation endpoint.

What impact does successful exploitation have?

The issue is a server-side request forgery in the Admin Center deploy validation endpoint. The provided vector indicates low confidentiality impact and no integrity or availability impact.

CVE-2026-11547: IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which Liberty versions are affected?

What access does an attacker need to exploit this issue?

What impact does successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which Liberty versions are affected?

What access does an attacker need to exploit this issue?

What impact does successful exploitation have?