CVE-2026-11714 is a server-side request forgery (SSRF) vulnerability in IBM WebSphere Application Server Liberty specifically when the apiDiscovery-1.0 feature is enabled. An attacker with low privileges can exploit this flaw to cause the server to send crafted requests to internal or external resources, potentially exposing sensitive information (high confidentiality impact) and causing limited integrity impact. The vulnerability does not affect availability. The CVSS v3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and scope change. The vulnerability affects version 17.0.0.3. No known exploits are reported in the wild and no official remediation or patch has been announced as of the publication date.

The vulnerability allows an attacker with low privileges to perform SSRF attacks, which can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited modification of data (integrity impact). There is no impact on availability. This could enable attackers to access internal systems or services that are otherwise inaccessible, potentially leading to further compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor IBM advisories for updates. Until a patch is available, consider disabling the apiDiscovery-1.0 feature if it is not required, or restrict network access to internal resources from the affected server to mitigate SSRF risk.