IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7281649", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH72166.\n\n\n\nFor IBM WebSphere Application Server traditional:\n\n\n\nFor V9.0.0.0 through 9.0.5.28:\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH72166 https://www.ibm.com/support/pages/node/7281092 \n--OR--\n\u00b7 Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).\u00a0\n\n\n\nFor V8.5.0.0 through 8.5.5.30:\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH72166 https://www.ibm.com/support/pages/node/7281092 \n--OR--\n\u00b7 Apply Fix Pack 8.5.5.31 or later (targeted availability 3Q2026).\u00a0\n\n\n\n\n\n\n\nAdditional interim fixes may be available and linked off the interim fix download page.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH72166.
For IBM WebSphere Application Server traditional:
For V9.0.0.0 through 9.0.5.28:
\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH72166
--OR--
\u00b7 Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).\u00a0
For V8.5.0.0 through 8.5.5.30:
\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH72166
--OR--
\u00b7 Apply Fix Pack 8.5.5.31 or later (targeted availability 3Q2026).\u00a0
Additional interim fixes may be available and linked off the interim fix download page.
"}]}], "x_generator": {"engine": "ibm-cvegen"}, "x_gcve": [{"vulnId": "CVE-2026-14512", "recordType": "advisory"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-14512"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T03:55:21.695Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-14512", "date": "2026-11-08", "epss": "0.0097", "percentile": "0.62128"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-14512\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2026-07-28T21:17:25.783\",\"lastModified\":\"2026-10-23T23:10:00.157\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.\"},{\"lang\":\"es\",\"value\":\"IBM WebSphere Servidor de Aplicaciones 9.0 y 8.5 tradicional es vulnerable a deserializaci\u00f3n insegura de preautenticaci\u00f3n, lo que podr\u00eda permitir a un atacante remoto omitir la autenticaci\u00f3n o ejecutar c\u00f3digo arbitrario.\"}],\"affected\":[{\"source\":\"psirt@us.ibm.com\",\"affectedData\":[{\"vendor\":\"IBM\",\"product\":\"WebSphere Application Server\",\"cpes\":[\"cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"9.0\",\"status\":\"affected\"},{\"version\":\"8.5\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-29T00:00:00+00:00\",\"id\":\"CVE-2026-14512\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.5.0.0\",\"versionEndExcluding\":\"8.5.5.31\",\"matchCriteriaId\":\"E9B7FD32-5DA2-4A69-B39E-A419DBC06221\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0.0\",\"versionEndExcluding\":\"9.0.5.29\",\"matchCriteriaId\":\"BA0DBCF1-7255-420A-B0A4-04C90BAE14F6\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7281649\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}", "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-14512\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-29T12:35:03.309061Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-29T12:35:07.667Z\"}}], \"cna\": {\"title\": \"IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"WebSphere Application Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0\"}, {\"status\": \"affected\", \"version\": \"8.5\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH72166.\\n\\n\\n\\nFor IBM WebSphere Application Server traditional:\\n\\n\\n\\nFor V9.0.0.0 through 9.0.5.28:\\n\\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH72166 https://www.ibm.com/support/pages/node/7281092 \\n--OR--\\n\\u00b7 Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).\\u00a0\\n\\n\\n\\nFor V8.5.0.0 through 8.5.5.30:\\n\\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH72166 https://www.ibm.com/support/pages/node/7281092 \\n--OR--\\n\\u00b7 Apply Fix Pack 8.5.5.31 or later (targeted availability 3Q2026).\\u00a0\\n\\n\\n\\n\\n\\n\\n\\nAdditional interim fixes may be available and linked off the interim fix download page.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH72166.
For IBM WebSphere Application Server traditional:
For V9.0.0.0 through 9.0.5.28:
\\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH72166
--OR--
\\u00b7 Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).\\u00a0
For V8.5.0.0 through 8.5.5.30:
\\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH72166
--OR--
\\u00b7 Apply Fix Pack 8.5.5.31 or later (targeted availability 3Q2026).\\u00a0
Additional interim fixes may be available and linked off the interim fix download page.
\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7281649\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"x_generator\": {\"engine\": \"ibm-cvegen\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of Untrusted Data\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-07-28T20:50:08.632Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2026-14512\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-29T12:35:12.583Z\", \"dateReserved\": \"2026-07-02T19:17:20.304Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-07-28T20:50:08.632Z\", \"assignerShortName\": \"ibm\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}