CVE-2026-14529
A critical flaw in IBM WebSphere Application Server allows attackers to trick the server into making arbitrary requests to internal or external resources. The vulnerability exists when the SIP container feature is enabled and can be exploited without authentication or user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
IBM WebSphere Application Server 9.0, 8.5, and IBM WebSphere Application Server – Liberty versions 17.0.0.3 through 26.0.0.8 when the SIP container (sipServlet-1.1) feature is enabled.
Real-world impact
An attacker could use the flaw to make the server reach internal services, exfiltrate data, or perform denial‑of‑service actions against internal systems.
Why this severity
The CVSS score of 9.4 reflects that the flaw is network‑based, requires no privileges, and can compromise confidentiality and integrity of data. The vector shows no user interaction is needed, and the impact is high for confidentiality and integrity, with a moderate impact on availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources