CVE-2026-14512 / CVE-2026-14446 — IBM WebSphere Application Server: two pre-auth CVSS 9.8 flaws with no workaround and no fix pack until 3Q2026 (interim APARs only)
IBM published two security bulletins on 2026-07-28 covering three flaws in WebSphere Application Server traditional, and Switzerland's NCSC carried both to its constituency on 2026-07-31 with the assessment that successful exploitation "allows unauthenticated remote attackers to bypass authentication, escalate privileges, and execute arbitrary code" (NCSC-CH, 2026-07-31). The first of the two, CVE-2026-14446, is what IBM classifies as CWE-306, missing authentication for a critical function, in the administrative console — a broken-access-control flaw the vendor describes as "broken access control/privilege escalation in the administrative console" and scores CVSS 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no credentials and no user interaction (IBM PSIRT, 2026-07-28). The second, CVE-2026-14512, is CWE-502 unsafe deserialization that IBM states is reachable "pre-authentication" and "could allow a remote attacker to bypass authentication or execute arbitrary code", also CVSS 9.8 on the same vector (IBM PSIRT, 2026-07-28). The same bulletin carries CVE-2026-14528 at CVSS 7.4, a CWE-532 flaw that writes sensitive information into log files, distinguished from the other two by a high attack complexity (IBM PSIRT, 2026-07-28).
What makes this worth acting on ahead of the normal patch cycle is not a score but the remediation state. IBM records the affected versions as WebSphere Application Server traditional 9.0.0.0 through 9.0.5.28 and versions 8.5.0.0 through 8.5.5.30, states "Workarounds and Mitigations: None", and offers only two paths for the console flaw — an interim fix resolving APAR DT496500, or Fix Pack 9.0.5.29 or 8.5.5.31 with a "targeted availability 3Q2026" (IBM PSIRT, 2026-07-28). The deserialization and log-disclosure pair is remediated by a different interim fix, resolving APAR PH72166, against the same fix-pack timeline and likewise with no workaround (IBM PSIRT, 2026-07-28). heise makes the same point about the release timing, noting that the corrected versions have so far only been announced for the third quarter (heise online, 2026-07-30). These three are not the whole of the batch: heise's account lists further WebSphere security bulletins carrying interim-fix guidance, among them a separate authentication bypass, a Liberty remote-code-execution and path-segment-injection pair, another cross-site-scripting and deserialization bulletin, and a Liberty denial-of-service issue, each remediated by its own interim fix (heise online, 2026-07-30). The cited article does not date those further bulletins, so no publication date is claimed for them here. This entry covers only the trio the Swiss national CERT carried; an operator applying the two interim fixes named here should work the wider batch rather than stopping at these.
An anonymous, no-interaction path to administrative control of a Java application server that commonly fronts banking, insurance and government back-office estates, with no configuration change that closes it and no scheduled fix pack for roughly two months, is an out-of-band decision rather than a patch-Tuesday item. Neither IBM, NCSC-CH nor heise reports any exploitation, and NCSC-CH records the exploitation status as unknown.
Detection concepts, telemetry class first. In web-server and application access logs for the WebSphere administrative console — typically the separate admin HTTP/HTTPS listener rather than the application listener — surface requests that reach privileged console endpoints and receive a success response without a preceding authenticated session or login event; the missing-authentication class means the give-away is a privileged action with no authentication record in front of it, not a failed-login burst. For the deserialization path, Java application-server telemetry is the anchor: unexpected class loading inside the JVM, ObjectInputStream activity on request-handling threads, and JVM crash-restart cycles on a host that was previously stable. Where the application server writes process-execution telemetry, a child process spawning from the WebSphere JVM is the post-exploitation signal. Hardening: apply the interim fixes; there is no vendor-supplied configuration workaround to fall back on.
IBM WebSphere Application Server traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
IBM WebSphere Application Server is vulnerable to broken access control/privilege escalation in the administrative console.
IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR DT496500.
Defender actions
- Apply the IBM interim fixes resolving APAR PH72166 and APAR DT496500 to every WebSphere Application Server traditional 9.0.x and 8.5.x instance now, and check the rest of IBM's concurrent WebSphere bulletin batch for the same estate — IBM states there is no workaround for these three and the permanent fix packs are not expected before 3Q2026.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Privilege Escalation TA0004
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.