CVE-2026-11714 is a server-side request forgery (SSRF) vulnerability (CWE-918) affecting IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.7 when the apiDiscovery-1.0 feature is enabled. The vulnerability allows an attacker with low privileges to cause the server to make unauthorized network requests, impacting confidentiality severely and integrity to a lesser extent. The CVSS v3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change. No vendor advisory or patch information is currently available to confirm remediation status.

An attacker with low privileges can exploit this SSRF vulnerability to induce the server to send unauthorized requests, potentially accessing or exfiltrating sensitive information (high confidentiality impact). The integrity impact is limited, and availability is not affected. This could lead to unauthorized internal network access or data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the apiDiscovery-1.0 feature if it is not required, or restrict access to the affected server components to trusted users only.