VulnSocial

CVE-2026-14512Patch(ibm / websphere_application_server)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch ibm websphere_application_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

ibm CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • websphere_application_server

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-07-31); latest day: 1
  • 5 total mentions across 4 days

Affected systems

Vendors
ibm
Products
websphere_application_server

Deep dive

Activity timeline5 mentions / 4d
01122Mentions · 2026-07-29: 1Mentions · 2026-07-31: 2Mentions · 2026-08-03: 1Mentions · 2026-09-26: 1Patch / Workaround · 2026-07-31: 2Patch / Workaround · 2026-08-03: 1Technical Details · 2026-07-31: 2Technical Details · 2026-08-03: 1Technical Details · 2026-09-26: 107-2907-3108-0309-26
Signal classification3 categories
Patch
240.0%
Disclosure
240.0%
General
120.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-291
General1
2026-07-312
Patch2
2026-08-031
Disclosure1
2026-09-261
Disclosure1
Full discourse5 posts
  • GovCERT.CZ@GOVCERT_CZ
    Disclosure

    🚨Upozorňujeme na zranitelnosti v IBM WebSphere Application Server, CVE-2026-14512, CVE-2026-14446, CVE-2026-14529 a CVE-2026-14528. CVE-2026-14512 je zranitelnost způsobená nebezpečnou deserializací, která může vzdálenému neautentizovanému útočníkovi umožnit obejít autentizaci nebo spustit libovolný kód. CVE-2026-14446 je způsobená nesprávnou autentizací v administrační konzoli, která může útočníkovi umožnit získat zvýšená oprávnění. CVE-2026-14529 je vysoce závažná zranitelnost typu server-side request forgery, která se týká prostředí se zapnutou funkcí SIP container a při úspěšném zneužití může neautentizovanému útočníkovi umožnit odesílat speciálně vytvořené požadavky na interní systémy. CVE-2026-14528 je zranitelnost vedoucí k úniku citlivých informací prostřednictvím logovacích souborů. Úspěšné zneužití těchto zranitelností může vést ke spuštění libovolného kódu, eskalaci oprávnění, přístupu k citlivým informacím nebo provádění SSRF útoků. Zranitelnosti se týkají IBM WebSphere Application Server 9.0, IBM WebSphere Application Server 8.5 a IBM WebSphere Application Server Liberty ve verzích 17.0.0.3 až 26.0.0.8. 📌Doporučujeme aktualizovat na nejnovější verzi.

    Post summary

    The message announces multiple CVEs in IBM WebSphere Application Server, details their technical characteristics and impacts, and advises users to update to the latest version.

    12030750
    4.3K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Four IBM WebSphere vulnerabilities are fixed, including a 9.8 pre-auth RCE (CVE-2026-14512) and a 9.4 SSRF (CVE-2026-14529). Patch now. #IBMWebSphere #CVE202614512 #SSRF #RCE #Vulnerability #InfoSec http://securityonline.info/ibm-websphere-vulnerabilities-rce/

    Post summary

    IBM WebSphere vulnerabilities CVE-2026-14512 (pre-auth RCE, CVSS 9.8) and CVE-2026-14529 (SSRF, CVSS 9.4) have been fixed; patches are now available.

    01100431
    12.6K followersView on X
  • IntegSec@integ_sec
    Disclosure

    CVE-2026-14512: IBM WebSphere Application Server Pre-Authentication Deserialization Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04ynp2X0

    Post summary

    The tweet announces CVE-2026-14512, an IBM WebSphere pre-authentication deserialization vulnerability, with a link to an article discussing business impact and response, but does not mention PoC, exploit code, active exploitation, or patches.

    0000038
    35 followersView on X
  • lee1981@lee1981b
    Patch

    🔥 CyberForge CVE of the Day #012 🚨CVE-2026-14512 IBM WebSphere pre-auth unsafe deserialization. ⭐ CVSS 9.8 ⭐ Auth bypass / potential RCE ⭐ No confirmed exploitation ⭐ Not in CISA KEV 🚨 Affected Versions: 9.0.0.0–9.0.5.28 8.5.0.0–8.5.5.30 Apply IBM’s PH72166 Interim Fix now. 🔗https://nvd.nist.gov/vuln/detail/CVE-2026-14512 #CyberForge #WebSphere #CVE #BlueTeam #RCE

    Post summary

    IBM WebSphere has a high‑severity unsafe deserialization flaw (CVE‑2026‑14512) that can lead to authentication bypass and potential RCE; an interim fix (PH72166) is available and no active exploitation has been reported.

    0000082
    541 followersView on X
  • VulDB 🛡@vuldb
    General

    There is a new vulnerability with elevated criticality in IBM WebSphere Application Server (CVE-2026-14512) https://vuldb.com/vuln/384006

    Post summary

    The post announces a newly identified critical vulnerability in IBM WebSphere Application Server (CVE-2026-14512) without providing additional technical or remediation information.

    00000117
    2.3K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appibmwebsphere_application_server---

Explore more

Back to dashboardibm CVEswebsphere_application_server vulnerabilities