01 Record

CVE-2026-14525

IBM WebSphere Application Server Liberty is affected by an authenication bypass

CriticalPUBLISHEDCNA: ibm

Base score9.4 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

View raw JSON CVE Program record

02 Description

IBM WebSphere Application Server Liberty is affected by an authenication bypass

03 Metadata

Published: 2026-08-13 19:37Z23 HR AGO
Last updated: 2026-08-13 19:37Z23 HR AGO
Reserved: 2026-07-02
Assigning CNA: ibm
Record state: PUBLISHED
Severity: Critical (CVSS 9.4)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Weaknesses: CWE-306
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: 17c67bf78817b1bd9d45b94c9c5e6c4117fb651480031e183a09c293840a7b0e

04 Affected products

VendorProductVersionsPlatforms

IBMWebSphere Application Server - Liberty17.0.0.3 to 26.0.0.8—

05 References

www.ibm.comhttps://www.ibm.com/support/pages/node/7283488vendor-advisorypatch

06 Remediation

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR DT496165. To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 . For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.8 using the rtcomm-1.0 or rtcommGateway-1.0 feature(s): · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves DT496165 https://www.ibm.com/support/pages/node/7283460 --OR-- · Apply Liberty Fix Pack 26.0.0.9 or later (targeted availability 3Q2026). Additional interim fixes may be available and linked off the interim fix download page.