CVE-2025-14917
Received Received - Intake
Security Misconfiguration in IBM WebSphere Liberty Admin Settings

Publication date: 2026-03-25

Last updated on: 2026-03-30

Assigner: IBM Corporation

Description
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-03-30
Generated
2026-06-16
AI Q&A
2026-03-26
EPSS Evaluated
2026-06-15
NVD
CVE-2025-14917
EUVD
EUVD-2025-209021
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
ibm websphere_application_server From 17.0.0.3 (inc) to 26.0.0.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1393 The product uses default passwords for potentially critical functionality.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.3 when certain appSecurity features (appSecurity-1.0 through appSecurity-5.0) are enabled. It results in weaker than expected security during the administration of security settings.

The issue is classified under CWE-1393, which relates to the use of default passwords, potentially allowing unauthorized access or control.

The vulnerability requires local access with high privileges and does not require user interaction, but it can have a high impact on confidentiality, integrity, and availability of the system.

Impact Analysis

If exploited, this vulnerability can lead to significant security risks including unauthorized access or modification of security settings within IBM WebSphere Application Server Liberty.

Because it impacts confidentiality, integrity, and availability at a high level, it could allow attackers with local high privileges to compromise sensitive data, alter system configurations, or disrupt service availability.

The vulnerability requires high privileges and local access, so the attacker would need to already have significant access to the system.

Mitigation Strategies

To mitigate the vulnerability in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.3, IBM recommends applying an interim fix or fix pack containing the fix for APAR PH70078.

Users should first upgrade to the minimal required fix pack levels and then apply the interim fix, following all post-installation instructions carefully.

Alternatively, users can apply Liberty Fix Pack 26.0.0.4 or later, which is targeted for availability in the second quarter of 2026.

No workarounds or other mitigations are provided.

Compliance Impact

The provided information does not explicitly address how the vulnerability in IBM WebSphere Application Server Liberty affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-14917. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart