Description
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint.
Published: 2026-11-08
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: Server-side request forgery
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a server-side request forgery in the Admin Center deploy validation endpoint of IBM WebSphere Application Server Liberty. By sending crafted HTTP requests, an attacker can cause the server to make outbound requests to arbitrary URLs. This flaw is a classic SSRF issue that could enable interactions with internal or external services from the scope of the server.

Affected Systems

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected. The fix is deployed through the Liberty Fix Pack 26.0.0.11 or later.

Risk and Exploitability

The CVSS base score of 4.3 indicates a moderate risk level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; an attacker only needs to reach the vulnerable Admin Center deploy validation endpoint and is not required to authenticate. Exploitation allows the attacker to trigger outbound requests to arbitrary URLs, effectively making the server act as a proxy for the attacker.

Generated by OpenCVE AI on November 8, 2026 at 18:52 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by applying the fix pack(s) listed below. For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.10: · Apply Liberty Fix Pack 26.0.0.11 https://www.ibm.com/support/pages/node/7294658 (availability November 2026) or later fix pack.

OpenCVE Recommended Actions

  • Apply the Liberty Fix Pack 26.0.0.11 or a later fix pack to the affected server.
  • Restrict access to the Admin Center deploy validation endpoint so that only trusted administrators can reach it.
  • Monitor the server for unexpected outbound requests and review logs for signs of exploitation.

Generated by OpenCVE AI on November 8, 2026 at 18:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 17:15:00 +0000

Type Values Removed Values Added
Description IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint.
Title IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
First Time appeared Ibm
Ibm websphere Application Server Liberty
Weaknesses CWE-918
CPEs cpe:2.3:a:ibm:websphere_application_server_liberty:17.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.10:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm websphere Application Server Liberty
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Ibm Websphere Application Server Liberty
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-08T17:00:47.163Z

Reserved: 2026-06-08T03:21:33.370Z

Link: CVE-2026-11547

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-08T17:16:37.580

Modified: 2026-11-08T17:16:37.687

Link: CVE-2026-11547

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T19:00:14Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)