IBM WebSphere App Server 8.5-9.0 Sensitive Info Disclosure via Admin Console Help
CVE-2026-11595 Published on June 30, 2026

IBM WebSphere Application Server is affected by a Path Traversal vulnerability
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2026-11595 has been classified to as a Directory traversal vulnerability or weakness.


Products Associated with CVE-2026-11595

Want to know whenever a new CVE is published for IBM WebSphere Application Server? stack.watch will email you.

IBM WebSphere Application Server
 

Affected Versions

IBM WebSphere Application Server: