CVE-2026-11595 is a path traversal vulnerability in IBM WebSphere Application Server versions 8.5 and 9.0. This vulnerability allows a remote attacker to bypass pathname restrictions and obtain sensitive information from the administrative console's integrated help system. The CVSS 3.1 vector indicates the attack requires adjacent network access with low complexity and no privileges or user interaction. The vulnerability impacts confidentiality but not integrity or availability. IBM has published the vulnerability but has not yet provided an official fix or remediation guidance.

A remote attacker with network access adjacent to the target system could exploit this vulnerability to access sensitive information from the administrative console's integrated help system. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the administrative console to trusted users and networks to reduce exposure.