CVE-2026-14446
IBM WebSphere Application Server versions 9.0 and 8.5 contain a broken access control vulnerability in the administrative console that could allow privilege escalation. The flaw is rated critical with a CVSS base score of 9.8. No known exploitation or public exploit is reported, and the provided sources do not document an official fix.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
IBM WebSphere Application Server 9.0 and 8.5
Real-world impact
An attacker could gain elevated privileges via the admin console, potentially leading to full control of the affected server.
Why this severity
CVSS 9.8 (Critical) reflects network‑adjacent attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources