CVE-2026-11595 IBM WebSphere Application Server is affected by a Path Traversal vulnerability

Medium 4.3 Published 30 Jun 2026 Updated 1 Jul 2026

Remote attackers can exploit a path traversal flaw in the administrative console's help system to obtain sensitive information.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-11595?

CVE-2026-11595 is a medium-severity path traversal vulnerability in Ibm Websphere Application Server, published on 30 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.

Weakness: CWE-22

Which versions are affected by CVE-2026-11595?

It affects 1 product.

Products include Ibm Websphere Application Server.

How do I fix CVE-2026-11595?

No fix has been published for CVE-2026-11595 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-11595 being exploited?

There is no known exploitation of CVE-2026-11595 in the wild and no public exploit code.

All Ibm Websphere Application Server vulnerabilities

Sources

Also known as GHSA-4qvc-jg4j-cv44.