On July 28, 2026, IBM published two separate security bulletins covering critical vulnerabilities in WebSphere Application Server traditional. CVE-2026-14512 is a pre-authentication unsafe deserialization flaw, classified as deserialization of untrusted data (CWE-502), that allows a remote attacker to bypass authentication or execute arbitrary code. CVE-2026-14446 is a broken access control and privilege escalation flaw in the administrative console, classified as missing authentication for a critical function (CWE-306).<\/p>\n\n\n\n
Both vulnerabilities carry a CVSS v3.1 base score of 9.8 (Critical). Both are reachable over the network, and neither requires privileges or user interaction to exploit.<\/p>\n\n\n\n
Neither flaw requires an attacker to hold valid credentials. For CVE-2026-14512, successful exploitation means code execution in the context of the application server process, which typically holds access to application data, connection credentials, and the back-end systems the server integrates with. For CVE-2026-14446, the target is the control plane itself: the administrative console is where applications are deployed and where server and security configuration is changed, so unauthorized privileged access to it is equivalent to control of the server.<\/p>\n\n\n\n
IBM lists no workarounds or mitigations for either vulnerability. The bulletin covering CVE-2026-14512 also addresses CVE-2026-14528, a lower-severity flaw in which sensitive information is written into log files, scored 7.4. IBM has not published details of the affected protocol or endpoint for the deserialization flaw, and no public exploit code or in-the-wild exploitation had been reported at the time of writing.<\/p>\n\n\n\n
Both vulnerabilities affect WebSphere Application Server traditional, versions 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.30. IBM lists both across the Advanced, Base, Developer, Enterprise, Express, Network Deployment, and Single Server editions, on AIX, IBM i, Linux, Windows, and z\/OS. WebSphere Application Server Liberty is not listed as affected by either flaw.<\/p>\n\n\n\n
In practice, an affected asset is a long-running Java EE application server sitting behind a web tier, frequently fronted by IBM HTTP Server and the WebSphere plug-in, and serving customer portals, order management, claims processing, payments, or similar core business functions. The administrative console is a separate surface on the same host, defaulting to These assets tend to be overlooked for structural reasons rather than careless ones. WebSphere deployments often predate the inventory systems meant to track them, and their hostnames rarely identify the platform underneath. Management interfaces intended for internal use become externally reachable through load balancer rules, legacy NAT configurations, or lift-and-shift cloud migrations that carry the original network exposure forward. Version upgrades are gated by application certification cycles, which is why estates sit on older fix pack levels long after a fix ships.<\/p>\n\n\n\n <\/p>\n\n\n\n Fixes are available. IBM has released interim fixes for both vulnerabilities, addressed by different APARs: PH72166 for CVE-2026-14512 and DT496500 for CVE-2026-14446. Because the two flaws are tracked separately, applying one does not remediate the other.<\/p>\n\n\n\n For both version families, IBM’s guidance is to upgrade to the minimum fix pack level the interim fix requires and then apply the interim fix, or alternatively to move to Fix Pack 9.0.5.29 for the 9.0 line or Fix Pack 8.5.5.31 for the 8.5 line. Those fix packs carry a targeted availability of 3Q2026, which means the interim fix route is the only path to remediation at the time of writing. IBM lists no workarounds for either vulnerability, so there is no configuration change that substitutes for the fix.<\/p>\n\n\n\n Organizations should confirm the current fix pack and interim fix availability directly with IBM for their specific version, platform, and edition rather than assuming a fix has shipped for their configuration.<\/p>\n\n\n\n Alongside remediation, defenders should:<\/p>\n\n\n\nTCP\/9060<\/code> for HTTP and TCP\/9043<\/code> for HTTPS at the \/ibm\/console<\/code> path.<\/p>\n\n\n\nAre fixes available?<\/h2>\n\n\n\n
Are there any other recommended actions to take?<\/h2>\n\n\n\n