CVE-2026-11540

MediumCVSS 5.3/10Last modified Sep 22, 2026

Description

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 18, 2026
Last modified
Sep 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1154004.4crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OACVE-2026-115419.8IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere ApplCVE-2026-1154115.0crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block CVE-2026-1154147.8OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration CVE-2026-1154167.7Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS accouCVE-2026-1154177.5Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actCVE-2026-1154198.1The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 doeCVE-2026-1154245.5A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properlyCVE-2026-1154493.5A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the hCVE-2026-115453.7IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console dCVE-2026-1154507.1External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an aCVE-2026-1154537.1Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows
CVE-2026-11540: Medium severity, CVSS 5.3 | Vulnix