CVE-2026-11546 is a server-side request forgery (SSRF) vulnerability in IBM WebSphere Application Server - Liberty when the adminCenter-1.0 feature is enabled. It affects versions starting from 17.0.0.3 through 26.0.0.7. The vulnerability allows an attacker with low privileges to cause the server to send crafted requests to internal or external resources, potentially leading to denial of service (availability impact). The CVSS v3.1 base score is 7.1 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact. No official patch or remediation level has been published yet, and no known exploits in the wild have been reported.

An attacker with low privileges can exploit this SSRF vulnerability to cause the server to make unintended requests, which may lead to denial of service conditions affecting availability. Confidentiality impact is low, and integrity is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users should monitor IBM's advisories for updates. Until a fix is available, consider disabling the adminCenter-1.0 feature if it is not required, as it is the condition for the vulnerability. No other specific mitigations are indicated.