CVE-2026-14512
IBM WebSphere Application Server versions 9.0 and 8.5 traditional are vulnerable to unsafe deserialization before authentication. An attacker can bypass login or run arbitrary code on the server. The flaw is exploitable remotely without any user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
IBM WebSphere Application Server 9.0 and 8.5 traditional.
Real-world impact
A remote attacker could log in without credentials or execute malicious code, potentially taking full control of the application server and any data it hosts.
Why this severity
The CVSS score of 9.8 reflects a remote, unauthenticated attack that grants complete compromise of confidentiality, integrity, and availability, with no user interaction required.
What to do about it
- ›Restrict network access to the affected WebSphere servers so only trusted hosts can reach them.
- ›Monitor server logs for suspicious authentication attempts or unexpected process activity.
- ›Apply any future IBM security patches or updates for WebSphere as soon as they are released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources