Arbitrary File Read Vulnerability in IBM WebSphere Application Server - Liberty
CVE-2026-11806

7.2HIGH

Key Information:

Vendor

IBM
Status
Websphere Application Server - Liberty
Vendor
CVE Published:
30 June 2026

What is CVE-2026-11806?

IBM WebSphere Application Server - Liberty, specifically from versions 17.0.0.3 to 26.0.0.6, is exposed to an arbitrary file read vulnerability. This issue arises when the restConnector-2.0 feature is enabled, allowing potential attackers to access restricted files. Exploiting this vulnerability could lead to sensitive information disclosure, making it critical for users of affected versions to apply patches and mitigate risks promptly. For further details and remediation, refer to the official IBM advisory.

Affected Version(s)

WebSphere Application Server - Liberty 17.0.0.3 <= 26.0.0.6

References

https://www.ibm.com/support/pages/node/7277536
vendor-advisorypatch

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.