CVE-2026-11806: 
IBM WebSphere Application Server vulnerability analysis and mitigation

CVE-2026-11806 is an arbitrary file read vulnerability affecting IBM WebSphere Application Server (WAS) - Liberty versions 17.0.0.3 through 26.0.0.6 when the restConnector-2.0 feature is enabled. The vulnerability was published on June 30, 2026, with a patch available as of the same date. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, though the GitHub Advisory Database and ENISA rate it at 7.2 (High) using a different vector reflecting high privilege requirements (GitHub Advisory, IBM Support).

The vulnerability is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling), mapped to CAPEC-33. When the restConnector-2.0 feature is enabled in WAS Liberty, an attacker can exploit inconsistent HTTP request handling to read arbitrary files from the server's filesystem. The NVD vector (AV:N/AC:L/PR:N/UI:N) suggests unauthenticated network exploitation is possible, while the IBM/ENISA vector (PR:H) indicates high privileges may be required — the discrepancy suggests the attack may be feasible under certain configurations without authentication or may require privileged REST API access depending on server configuration (GitHub Advisory, IBM Support).

Successful exploitation results in unauthorized disclosure of arbitrary files on the host system running IBM WAS Liberty, with high confidentiality impact and no integrity or availability impact under the primary NVD scoring. Sensitive files such as configuration files, credentials, private keys, or application data accessible to the WAS Liberty process could be exposed to an attacker. This data exposure could facilitate further lateral movement or privilege escalation within the affected environment (GitHub Advisory, IBM Support).

IBM has released a fix in WebSphere Application Server - Liberty version 26.0.0.7 and later; organizations should upgrade immediately (IBM Support). As an interim workaround, disable the restConnector-2.0 feature in the server.xml configuration if it is not operationally required. Additionally, restrict network access to the WAS Liberty REST connector endpoints to trusted administrators only using firewall rules or network segmentation.