CVE-2026-11714 IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability

🗓️ 30 Jun 2026 19:44:49Reported by ibmType

CVE-2026-11714: Liberty versions 17.0.0.3–26.0.0.7 have authorization bypass and server side request forgery when apiDiscovery-1.0 is enabled.

Reporter	Title	Published	Views	Family All 16
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	27 Jul 202614:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by an authorization bypass vulnerability (CVE-2026-11714)	7 Jul 202619:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by an authorization bypass vulnerability (CVE-2026-11714)	7 Jul 202619:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty	10 Aug 202619:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability (CVE-2026-11714)	6 Aug 202618:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by an authorization bypass vulnerability (CVE-2026-11714)	7 Jul 202619:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by an authorization bypass vulnerability (CVE-2026-11714)	5 Aug 202606:36	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty	24 Jul 202604:47	–	ibm
ATTACKERKB	CVE-2026-11714	30 Jun 202619:44	–	attackerkb
Circl	CVE-2026-11714	2 Jul 202608:28	–	circl

[
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server - Liberty",
    "versions": [
      {
        "status": "affected",
        "version": "17.0.0.3",
        "lessThanOrEqual": "26.0.0.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.7:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7278580

06 Aug 2026 17:40Current

CVSS 3.18.5

EPSS0.00207

CWE-918