IBM WebSphere Application Server and WebSphere Application Server Liberty contain a virtual host bypass vulnerability (CVE-2026-11549) that allows unauthorized access by circumventing virtual host restrictions. The vulnerability has a CVSS v3.1 base score of 6.5, indicating medium severity. No patch or remediation information is currently available, and no exploits are known to be active in the wild.