CVE-2026-11546: IBM WebSphere Liberty SSRF Vulnerability in adminCenter

Technical summary

The vulnerability is classified as CWE-918 (Server-Side Request Forgery). It manifests in the adminCenter-1.0 component of WebSphere Application Server Liberty, allowing an authenticated user to craft requests that cause the server to initiate connections to arbitrary targets. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) indicates network accessibility, low attack complexity, and authentication requirement; the high availability impact suggests potential for denial of service or resource exhaustion via forced requests to expensive or unresponsive endpoints. Confidentiality impact is rated as low, indicating limited exposure of sensitive data directly through the SSRF itself.

Business impact

Organizations relying on WebSphere Application Server Liberty for application hosting face potential service disruption if an authenticated user exploits this SSRF to target internal infrastructure. The vulnerability can be leveraged to scan internal networks, reach restricted services, or exhaust resources by forcing the server to perform repeated requests. In environments where admin center is exposed to a broad set of authenticated users, attack surface widens accordingly. Downtime or performance degradation could disrupt business operations dependent on Liberty-hosted applications.

Affected systems

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 are affected, provided that the adminCenter-1.0 feature is enabled in the server configuration. Organizations running earlier versions (pre-17.0.0.3) or later versions (post-26.0.0.7) are not impacted by this specific CVE. The vulnerability is active only in instances where admin center functionality is explicitly enabled; default or minimal installations without this feature are not vulnerable.

Exploitability

Exploitation requires valid authentication credentials, which significantly raises the barrier to attack compared to unauthenticated SSRF flaws. However, the low attack complexity means that any authenticated user—including those with limited privileges—can likely trigger the vulnerability without sophisticated techniques. The ability to make the server initiate arbitrary requests is realizable through standard HTTP requests directed at the vulnerable component. No user interaction is required once the attacker has credentials. The lack of KEV (Known Exploited Vulnerability) status indicates no evidence of active exploitation in the wild at time of publication, though this does not rule out future weaponization.

Remediation

Organizations should update IBM WebSphere Application Server Liberty to a patched version beyond 26.0.0.7. Administrators should consult IBM's official security advisories and release notes to verify the exact patched version available for their deployment. As an interim mitigation, if operationally feasible, disable the adminCenter-1.0 feature unless it is actively required for administration. Restrict network access to the admin center interface using firewall rules or application-level access controls to limit the pool of authenticated users who can reach the vulnerable component.

Patch guidance

Verify availability of patches for your specific WebSphere Application Server Liberty version against the IBM security advisory. Organizations running version 26.0.0.7 or earlier should prioritize testing and deployment of the next available patch release. If you are unable to immediately patch, implement compensating controls such as disabling admin center, restricting admin center access via network segmentation, and enhancing monitoring of outbound connections initiated by the Liberty process. Test patches in a non-production environment before production rollout to ensure compatibility with custom applications and configurations.

Detection guidance

Monitor WebSphere Application Server Liberty logs and network traffic for suspicious patterns originating from the admin center component. Look for unusual outbound connections from the Liberty JVM process to internal or unexpected external hosts. Enable detailed logging for the adminCenter-1.0 component if available. Network-based detection should focus on unexpected egress from the Liberty server to ports and destinations outside normal baselines. Correlate Liberty application logs with network flow data to identify requests that appear to originate from admin center processing. Consider deploying WAF rules or reverse proxy inspection to detect malformed or suspicious requests to the admin center endpoint if it is exposed via a web tier.

Why prioritize this

This vulnerability merits high-priority remediation due to its HIGH CVSS severity (7.1), the broad version range affected (spanning 9 major/minor versions), and the availability impact that could affect business-critical applications. While authentication is required, the low attack complexity and high availability impact make it a credible threat in environments where internal attackers or compromised accounts exist. The lack of current exploitation activity should not lower urgency; SSRF vulnerabilities historically attract researcher and attacker interest. Given the scale of WebSphere Liberty deployments in enterprise environments, patch delivery should begin promptly.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects the combination of network accessibility (AV:N), low barriers to exploitation (AC:L), the authentication requirement (PR:L) which moderates the score, and significant impact to availability (A:H) with limited confidentiality exposure (C:L). The score appropriately captures a flaw that is exploitable but not trivial, with meaningful business impact. The availability rating acknowledges that attackers can degrade service or trigger resource exhaustion. The integrity rating of N (no impact) indicates the SSRF does not directly enable data modification, though indirect impacts via compromised internal systems remain a concern outside the strict CVSS model.

Frequently asked questions