IBM WebSphere Vulnerabilities (CVSS 9.8) Enable RCE, Privilege Escalation, and SSRF

TL;DR

IBM disclosed four IBM WebSphere vulnerabilities in late July 2026. Two of them, CVE-2026-14512 and CVE-2026-14446, each score 9.8 CVSS. A new server-side request forgery flaw, CVE-2026-14529, adds a 9.4 score. IBM reports no public exploitation so far.

Why it matters

WebSphere runs core Java applications for banks, retailers, and governments. So a server takeover puts critical business systems at risk. The most severe flaw needs no login at all.

These IBM WebSphere vulnerabilities open several attack paths. An attacker could run code, seize admin rights, forge internal requests, or read sensitive data. As a result, patching should move to the top of the queue.

How the attacks work

Pre-auth deserialization

CVE-2026-14512 stems from unsafe deserialization of untrusted data. A remote attacker sends crafted objects before authentication. The server then bypasses auth checks or runs arbitrary code. It scores 9.8.

Console privilege escalation

CVE-2026-14446 is a broken access control flaw in the admin console. It misses authentication on a critical function, so an attacker gains elevated rights. A third issue, CVE-2026-14528, leaks sensitive data through log files.

SIP container SSRF

The flaw, CVE-2026-14529, is a server-side request forgery bug. It appears when the SIP container feature, sipServlet-1.1, is enabled. An unauthenticated attacker can then force the server to send crafted internal requests. IBM rates it 9.4.

Affected versions

The three traditional-only flaws affect WebSphere Application Server 9.0 and 8.5. Version 9.0 is affected through 9.0.5.28, and 8.5 through 8.5.5.30. The SSRF reaches further. It also affects WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.8. IBM reports no public exploitation or proof-of-concept so far.

Patch and mitigation

Apply the interim fixes now, since IBM lists no workarounds. The deserialization and log issues ship under APAR PH72166. The privilege escalation fix lands in APAR DT496500. For the SSRF, apply the fix for APAR PH72053 on Liberty or DT495928 on traditional.

Until fixes land, restrict network access to the admin console. Also disable the SIP container feature if you do not need it. Fix Packs 9.0.5.29, 8.5.5.31, and Liberty 26.0.0.9 target 3Q2026.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.