CVE-2026-11546 is a server-side request forgery (SSRF) vulnerability in IBM WebSphere Application Server - Liberty when the adminCenter-1.0 feature is enabled. The affected versions include 17.0.0.3 through 26.0.0.7. The vulnerability allows an attacker with low privileges to induce the server to send unauthorized network requests, which can lead to denial of service (availability impact). The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact. No official patch or remediation level is currently provided by IBM, and no known exploits are reported in the wild.

An attacker with low privileges can exploit this SSRF vulnerability to cause the server to make unauthorized requests, potentially leading to denial of service conditions. Confidentiality impact is low, integrity is not affected, but availability impact is high. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor IBM's security advisories for updates. In the meantime, consider disabling the adminCenter-1.0 feature if it is not required to reduce exposure.