CVE-2026-11546 is a high-severity server-side request forgery (CVSS 7.1) in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6 when the adminCenter-1.0 feature is enabled. IBM recommends the interim fix for APAR PH71841, or Liberty Fix Pack 26.0.0.7 or later, and lists no workaround.
What's affected
From the IBM security bulletin and the CVE record:
- Product: IBM WebSphere Application Server Liberty, 17.0.0.3 through 26.0.0.6, only when the
adminCenter-1.0feature is enabled. The CVE description says through 26.0.0.7, while the bulletin table lists 26.0.0.6. Treat both as in scope until you have applied a fix. - Fix: upgrade to the minimum fix pack level the interim fix requires, then apply the interim fix for APAR PH71841, or apply Liberty Fix Pack 26.0.0.7 or later. IBM listed Fix Pack 26.0.0.7 as targeted for the third quarter of 2026 when it published the bulletin, so confirm it is available to you.
- Workarounds: IBM lists none.
- Weakness class: CWE-918 (server-side request forgery).
- Severity: CVSS 7.1. The vector needs low privileges and no user interaction, with Low impact on confidentiality and High impact on availability.
How to check if you're exposed
The flaw applies only when the Admin Center feature is on, so the first check is the feature list.
- Search the server configuration for the feature. Include any files pulled in by
includeelements inserver.xml.
grep -rn "adminCenter-1.0" <wlp_install>/usr/servers/*/
- Read the Liberty version:
<wlp_install>/bin/productInfo version
- IBM also publishes a page titled How to determine if Liberty is using a specific feature. Use it if your configuration is built from many files or from environment variables.
If the feature is not enabled, this CVE does not apply to that server, but you should still plan to move to the fix pack in normal maintenance.
What to do now
- List every Liberty server and check whether
adminCenter-1.0is enabled, using the steps above. - On servers that use it, apply the interim fix for PH71841 after moving to the minimum fix pack level it requires, or move to Fix Pack 26.0.0.7 or later.
- If you do not need the Admin Center, remove the feature from the feature list. IBM lists no workaround, but removing an unused feature removes the exposure.
- Limit who can reach the Admin Center to administrators on a management network, since the flaw needs a low privileged account.
- Record the version and fix level in your inventory so the next advisory is quicker to answer.
Why it matters
Server-side request forgery means an attacker gets a server to make an HTTP request on their behalf. The request comes from the server, so it can reach internal services that the attacker could not contact directly, and it carries the server network position. That is why SSRF is often a stepping stone to internal systems or cloud metadata services.
IBM does not describe the request path for this CVE beyond naming the Admin Center feature, and we do not speculate. The CVSS vector rates the impact on availability as High and on confidentiality as Low, and requires a low privileged account. Admin interfaces should not be broadly reachable in any case. Limiting access to them is a good habit that also reduces this risk.
Quick check
Does this affect Liberty if I do not use the Admin Center?
The advisory ties the flaw to servers with adminCenter-1.0 enabled. If the feature is off, the described issue does not apply, but you should still update in normal maintenance.
Is there a workaround?
IBM lists none. Removing the feature when you do not need it is a sensible way to cut exposure, but it is not an IBM supplied workaround.
Sources
- Gold entry and CVE record: CVE-2026-11546.
- IBM security bulletin for CVE-2026-11546, initial publication 30 June 2026, updated 13 July 2026.
Last reviewed: 19 October 2026.
