--- schema: 1 kind: vulnerability title: "CVE-2026-14512 / CVE-2026-14446 — IBM WebSphere Application Server: two pre-auth CVSS 9.8 flaws with no workaround and no fix pack until 3Q2026 (interim APARs only)" headline: "IBM ships interim APARs, not a fix pack, for a pre-auth deserialization RCE and a missing-authentication flaw in the WebSphere admin console" summary: > IBM disclosed two CVSS 9.8 pre-authentication flaws on 2026-07-28 affecting WebSphere Application Server traditional versions 9.0.0.0 through 9.0.5.28 and versions 8.5.0.0 through 8.5.5.30, and NCSC-CH carried them to its Swiss constituency on 2026-07-31. CVE-2026-14512 is unsafe deserialization reachable without authentication; CVE-2026-14446 is missing authentication for a critical function in the administrative console, giving an unauthenticated network-reachable caller a path to elevated privileges. IBM states there is no workaround and the permanent fix packs (9.0.5.29 / 8.5.5.31) are only targeted for 3Q2026, so the only remediation available now is an interim fix. No exploitation is reported by any party. discovered_at: "2026-08-01T04:31:06Z" event_date: "2026-07-28" run_id: 2026-08-01T0409Z-intel priority: high immediate_action: null tags: [vulnerabilities, rce, pre-auth, auth-bypass, priv-esc, patch-available] regions: [global] sectors: [public-sector, finance] entities: [] techniques: [T1190, T1068] affected_products: ["IBM WebSphere Application Server"] cves: - id: CVE-2026-14512 cvss: "9.8" epss: null type: deserialization vector: zero-click auth: pre-auth status: [patch-available] affected: "WebSphere Application Server traditional 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.30" fixed: "Interim fix resolving APAR PH72166; Fix Pack 9.0.5.29 / 8.5.5.31 targeted 3Q2026" - id: CVE-2026-14446 cvss: "9.8" epss: null type: auth-bypass vector: zero-click auth: pre-auth status: [patch-available] affected: "WebSphere Application Server traditional 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.30" fixed: "Interim fix resolving APAR DT496500; Fix Pack 9.0.5.29 / 8.5.5.31 targeted 3Q2026" - id: CVE-2026-14528 cvss: "7.4" epss: null type: info-disclosure vector: zero-click auth: pre-auth status: [patch-available] affected: "WebSphere Application Server traditional 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.30" fixed: "Interim fix resolving APAR PH72166; Fix Pack 9.0.5.29 / 8.5.5.31 targeted 3Q2026" sources: - url: "https://www.ibm.com/support/pages/node/7281631" publisher: "IBM PSIRT" date: "2026-07-28" role: primary - url: "https://www.ibm.com/support/pages/node/7281649" publisher: "IBM PSIRT" date: "2026-07-28" role: primary - url: "https://security-hub.ncsc.admin.ch/#/posts/12821" publisher: "NCSC Switzerland (GovCERT.ch) Cyber Security Hub" date: "2026-07-31" role: corroborating - url: "https://www.heise.de/news/IBM-WebSphere-Application-Server-Sicherheitsproblem-in-Admin-Konsole-geloest-11386356.html" publisher: "heise online" date: "2026-07-30" role: corroborating closed_sources: [] evidence: - quote: "IBM WebSphere Application Server traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code." publisher: "IBM PSIRT" - quote: "IBM WebSphere Application Server is vulnerable to broken access control/privilege escalation in the administrative console." publisher: "IBM PSIRT" - quote: "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR DT496500." publisher: "IBM PSIRT" verification: multi-source sourcing_note: > Both bulletins are IBM's own, published 2026-07-28; the in-window trigger for this entry is NCSC-CH's advisory of 2026-07-31, which carries the pair to the Swiss constituency, plus heise's 2026-07-30 report. Affected and fixed ranges and both APAR numbers are read from the bulletins' own Affected Products and Remediation/Fixes sections rather than from any summary. IBM assigns both CVSS 9.8 scores itself; no third party has published an independent score, and no CVSS is available for the pair from a national CERT. confidence: high update_of: null references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 1 watchlist_hit: false actions: - "Apply the IBM interim fixes resolving APAR PH72166 and APAR DT496500 to every WebSphere Application Server traditional 9.0.x and 8.5.x instance now, and check the rest of IBM's concurrent WebSphere bulletin batch for the same estate — IBM states there is no workaround for these three and the permanent fix packs are not expected before 3Q2026." migrated_from: null --- IBM published two security bulletins on 2026-07-28 covering three flaws in WebSphere Application Server traditional, and Switzerland's NCSC carried both to its constituency on 2026-07-31 with the assessment that successful exploitation "allows unauthenticated remote attackers to bypass authentication, escalate privileges, and execute arbitrary code" ([NCSC-CH, 2026-07-31](https://security-hub.ncsc.admin.ch/#/posts/12821)). The first of the two, `CVE-2026-14446`, is what IBM classifies as CWE-306, missing authentication for a critical function, in the administrative console — a broken-access-control flaw the vendor describes as "broken access control/privilege escalation in the administrative console" and scores CVSS 9.8 with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, meaning no credentials and no user interaction ([IBM PSIRT, 2026-07-28](https://www.ibm.com/support/pages/node/7281631)). The second, `CVE-2026-14512`, is CWE-502 unsafe deserialization that IBM states is reachable "pre-authentication" and "could allow a remote attacker to bypass authentication or execute arbitrary code", also CVSS 9.8 on the same vector ([IBM PSIRT, 2026-07-28](https://www.ibm.com/support/pages/node/7281649)). The same bulletin carries `CVE-2026-14528` at CVSS 7.4, a CWE-532 flaw that writes sensitive information into log files, distinguished from the other two by a high attack complexity ([IBM PSIRT, 2026-07-28](https://www.ibm.com/support/pages/node/7281649)). What makes this worth acting on ahead of the normal patch cycle is not a score but the remediation state. IBM records the affected versions as WebSphere Application Server traditional 9.0.0.0 through 9.0.5.28 and versions 8.5.0.0 through 8.5.5.30, states "Workarounds and Mitigations: None", and offers only two paths for the console flaw — an interim fix resolving APAR DT496500, or Fix Pack 9.0.5.29 or 8.5.5.31 with a "targeted availability 3Q2026" ([IBM PSIRT, 2026-07-28](https://www.ibm.com/support/pages/node/7281631)). The deserialization and log-disclosure pair is remediated by a different interim fix, resolving APAR PH72166, against the same fix-pack timeline and likewise with no workaround ([IBM PSIRT, 2026-07-28](https://www.ibm.com/support/pages/node/7281649)). heise makes the same point about the release timing, noting that the corrected versions have so far only been announced for the third quarter ([heise online, 2026-07-30](https://www.heise.de/news/IBM-WebSphere-Application-Server-Sicherheitsproblem-in-Admin-Konsole-geloest-11386356.html)). These three are not the whole of the batch: heise's account lists further WebSphere security bulletins carrying interim-fix guidance, among them a separate authentication bypass, a Liberty remote-code-execution and path-segment-injection pair, another cross-site-scripting and deserialization bulletin, and a Liberty denial-of-service issue, each remediated by its own interim fix ([heise online, 2026-07-30](https://www.heise.de/news/IBM-WebSphere-Application-Server-Sicherheitsproblem-in-Admin-Konsole-geloest-11386356.html)). The cited article does not date those further bulletins, so no publication date is claimed for them here. This entry covers only the trio the Swiss national CERT carried; an operator applying the two interim fixes named here should work the wider batch rather than stopping at these. An anonymous, no-interaction path to administrative control of a Java application server that commonly fronts banking, insurance and government back-office estates, with no configuration change that closes it and no scheduled fix pack for roughly two months, is an out-of-band decision rather than a patch-Tuesday item. Neither IBM, NCSC-CH nor heise reports any exploitation, and NCSC-CH records the exploitation status as unknown. Detection concepts, telemetry class first. In web-server and application access logs for the WebSphere administrative console — typically the separate admin HTTP/HTTPS listener rather than the application listener — surface requests that reach privileged console endpoints and receive a success response without a preceding authenticated session or login event; the missing-authentication class means the give-away is a privileged action with no authentication record in front of it, not a failed-login burst. For the deserialization path, Java application-server telemetry is the anchor: unexpected class loading inside the JVM, `ObjectInputStream` activity on request-handling threads, and JVM crash-restart cycles on a host that was previously stable. Where the application server writes process-execution telemetry, a child process spawning from the WebSphere JVM is the post-exploitation signal. Hardening: apply the interim fixes; there is no vendor-supplied configuration workaround to fall back on.