CVE-2026-11806

🗓️ 30 Jun 2026 19:43:17Reported by ibmType

CVE-2026-11806 affects Liberty 17.0.0.3–26.0.0.6 with restConnector-2.0 enabled, allowing file read.

Reporter	Title	Published	Views	Family All 19
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability (CVE-2026-11806)	23 Jun 202613:21	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty	16 Jul 202616:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.	27 Jul 202617:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty	24 Jul 202604:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by an arbitrary file read vulnerability (CVE-2026-11806)	6 Jul 202621:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server - Liberty is affected by multiple vulnerabilities	11 Aug 202614:31	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in WebSphere Application Server Liberty affect Cloud Pak System Pattern Type	31 Jul 202616:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a an arbitrary file read vulnerability (CVE-2026-11806)	6 Jul 202621:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms.	27 Jul 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in IBM WebSphere Application (CVE-2026-50645, CVE-2026-9322, CVE-2026-11541, CVE-2026-4410, CVE-2026-9320, CVE-2026-8646, CVE-2026-11806, CVE-2026-9071, CVE-2026-11546, CVE-2026-5516) affects IBM PowerVM Novalink.	16 Jul 202615:19	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange17.0.0.3–26.0.0.7liberty

[
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server - Liberty",
    "versions": [
      {
        "status": "affected",
        "version": "17.0.0.3",
        "lessThanOrEqual": "26.0.0.6",
        "versionType": "semver"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.6:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7277536

02 Jul 2026 17:58Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.2 - 7.5

EPSS0.00262

SSVC

CWE-444