Vulnerability · Published Jul 29, 2026 · Assigned by ibm

CVE-2026-14529IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery

Critical 9.4

In plain English

A critical-severity missing authentication in WebSphere Application Server from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)9.4Critical

Exploit odds (30 days)0.5%top 55.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

Affected products (as reported)

Vendor	Product	Versions
IBM	WebSphere Application Server	9.08.5
IBM	WebSphere Application Server - Liberty	17.0.0.3 – through 26.0.0.8

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

https://www.ibm.com/support/pages/node/7281721 vendor-advisory, patch