IBM WebSphere Application Server traditional — missing authentication for critical function in the administrative console (CWE-306), CVSS 9.8; interim fix APAR DT496500, Fix Pack targeted 3Q2026

CVE-2026-14512 / CVE-2026-14446 — IBM WebSphere Application Server: two pre-auth CVSS 9.8 flaws with no workaround and no fix pack until 3Q2026 (interim APARs only)

IBM published two security bulletins on 2026-07-28 covering three flaws in WebSphere Application Server traditional, and Switzerland's NCSC carried both to its constituency on 2026-07-31 with the assessment that successful exploitation "allows unauthenticated remote attackers to bypass authentication, escalate privileges, and execute arbitrary code" (NCSC-CH, 2026-07-31). The first of the two, CVE-2026-14446, is what IBM classifies as CWE-306, missing authentication for a critical function, in the administrative console — a broken-access-control flaw the vendor describes as "broken access control/privilege escalation in the administrative console" and scores CVSS 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no credentials and no user interaction (IBM PSIRT, 2026-07-28). The second, CVE-2026-14512, is CWE-502 unsafe deserialization that IBM states is reachable "pre-authentication" and "could allow a remote attacker to bypass authentication or execute arbitrary code", also CVSS 9.8 on the same vector (IBM PSIRT, 2026-07-28). The same bulletin carries CVE-2026-14528 at CVSS 7.4, a CWE-532 flaw that writes sensitive information into log files, distinguished from the other two by a high attack complexity (IBM PSIRT, 2026-07-28).

What makes this worth acting on ahead of the normal patch cycle is not a score but the remediation state. IBM records the affected versions as WebSphere Application Server traditional 9.0.0.0 through 9.0.5.28 and versions 8.5.0.0 through 8.5.5.30, states "Workarounds and Mitigations: None", and offers only two paths for the console flaw — an interim fix resolving APAR DT496500, or Fix Pack 9.0.5.29 or 8.5.5.31 with a "targeted availability 3Q2026" (IBM PSIRT, 2026-07-28). The deserialization and log-disclosure pair is remediated by a different interim fix, resolving APAR PH72166, against the same fix-pack timeline and likewise with no workaround (IBM PSIRT, 2026-07-28). heise makes the same point about the release timing, noting that the corrected versions have so far only been announced for the third quarter (heise online, 2026-07-30). These three are not the whole of the batch: heise's account lists further WebSphere security bulletins carrying interim-fix guidance, among them a separate authentication bypass, a Liberty remote-code-execution and path-segment-injection pair, another cross-site-scripting and deserialization bulletin, and a Liberty denial-of-service issue, each remediated by its own interim fix (heise online, 2026-07-30). The cited article does not date those further bulletins, so no publication date is claimed for them here. This entry covers only the trio the Swiss national CERT carried; an operator applying the two interim fixes named here should work the wider batch rather than stopping at these.

An anonymous, no-interaction path to administrative control of a Java application server that commonly fronts banking, insurance and government back-office estates, with no configuration change that closes it and no scheduled fix pack for roughly two months, is an out-of-band decision rather than a patch-Tuesday item. Neither IBM, NCSC-CH nor heise reports any exploitation, and NCSC-CH records the exploitation status as unknown.

Detection concepts, telemetry class first. In web-server and application access logs for the WebSphere administrative console — typically the separate admin HTTP/HTTPS listener rather than the application listener — surface requests that reach privileged console endpoints and receive a success response without a preceding authenticated session or login event; the missing-authentication class means the give-away is a privileged action with no authentication record in front of it, not a failed-login burst. For the deserialization path, Java application-server telemetry is the anchor: unexpected class loading inside the JVM, ObjectInputStream activity on request-handling threads, and JVM crash-restart cycles on a host that was previously stable. Where the application server writes process-execution telemetry, a child process spawning from the WebSphere JVM is the post-exploitation signal. Hardening: apply the interim fixes; there is no vendor-supplied configuration workaround to fall back on.