CVE-2026-11806 is a vulnerability in IBM WebSphere Application Server - Liberty affecting versions 17.0.0.3 through 26.0.0.6 when the restConnector-2.0 feature is enabled. The issue arises from inconsistent interpretation of HTTP requests (CWE-444), enabling an attacker with high privileges to perform arbitrary file reads. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker with high privileges can exploit this vulnerability to read arbitrary files on the affected system, potentially exposing sensitive information and compromising system integrity and availability. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the restConnector-2.0 feature and limit privileges to trusted users only to reduce risk.