Path traversal in IBM WebSphere Application Server - CVE-2026-11595

Vulnerability identifier: #VU136697

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-11595

CWE-ID: CWE-22

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to obtain sensitive information.

The vulnerability exists due to input validation error when processing directory traversal sequences. An adjacent attacker can send a specially crafted HTTP request and obtain sensitive information from the administrative console's integrated help system.

IBM WebSphere Application Server
Enterprise Application Runtimes
Tivoli Network Manager IP Edition
WebSphere Hybrid Edition
Cloud Pak for Applications
IBM Tivoli System Automation Application Manager
IBM Security Guardium Key Lifecycle Manager (GKLM)
WebSphere Service Registry and Repository
WebSphere Remote Server
IBM Rational ClearQuest

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 8.5.5.31, 9.0.5.29

• https://www.ibm.com/support/pages/node/7278590

• Path traversal in IBM WebSphere Application Server
• Multiple vulnerabilities in IBM Guardium Key Lifecycle Manager (SKLM/GKLM)
• Multiple vulnerabilities in IBM WebSphere Hybrid Edition
• Multiple vulnerabilities in IBM WebSphere Remote Server
• Multiple vulnerabilities in IBM Enterprise Application Runtimes
• Multiple vulnerabilities in IBM Cloud Pak for Applications
• Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
• Multiple vulnerabilities in IBM Rational ClearQuest
• Multiple vulnerabilities in IBM Tivoli System Automation Application Manager