CVE-2026-11537 describes a vulnerability in IBM WebSphere Application Server 8.5 and 9.0 where the FileTransfer servlet trusts HTTP permission methods on the server side, potentially allowing remote attackers to access sensitive file system information. The issue is categorized under CWE-650 (Trusting HTTP Permission Methods on the Server Side). The CVSS 3.1 base score is 4.3, indicating a medium severity with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

A remote attacker can obtain sensitive information about the file system via the vulnerable FileTransfer servlet. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to the FileTransfer servlet and monitor for suspicious activity related to file system information disclosure.