CVE-2026-11806 is a vulnerability in IBM WebSphere Application Server - Liberty (specifically version 17.0.0.3) related to CWE-444, which involves inconsistent interpretation of HTTP requests, commonly referred to as HTTP Request/Response Smuggling. This flaw enables an attacker to perform arbitrary file read operations when the restConnector-2.0 feature is enabled. The vulnerability has a CVSS 3.1 score of 7.2, reflecting high impact on confidentiality, integrity, and availability. The vendor has not provided a remediation level or patch information at this time.

Successful exploitation of this vulnerability can lead to arbitrary file read on the affected system, potentially exposing sensitive information. The CVSS vector indicates network attack vector with low attack complexity but requires high privileges. The impact includes high confidentiality, integrity, and availability consequences. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the restConnector-2.0 feature if feasible and restrict access to the affected server to trusted users with high privileges. Monitor IBM advisories for updates on patches or official mitigations.