CVE-2025-14917
Security Misconfiguration in IBM WebSphere Liberty Admin Settings
Publication date: 2026-03-25
Last updated on: 2026-03-30
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | websphere_application_server | From 17.0.0.3 (inc) to 26.0.0.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1393 | The product uses default passwords for potentially critical functionality. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not explicitly address how the vulnerability in IBM WebSphere Application Server Liberty affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability affects IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.3 when certain appSecurity features (appSecurity-1.0 through appSecurity-5.0) are enabled. It results in weaker than expected security during the administration of security settings.
The issue is classified under CWE-1393, which relates to the use of default passwords, potentially allowing unauthorized access or control.
The vulnerability requires local access with high privileges and does not require user interaction, but it can have a high impact on confidentiality, integrity, and availability of the system.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to significant security risks including unauthorized access or modification of security settings within IBM WebSphere Application Server Liberty.
Because it impacts confidentiality, integrity, and availability at a high level, it could allow attackers with local high privileges to compromise sensitive data, alter system configurations, or disrupt service availability.
The vulnerability requires high privileges and local access, so the attacker would need to already have significant access to the system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.3, IBM recommends applying an interim fix or fix pack containing the fix for APAR PH70078.
Users should first upgrade to the minimal required fix pack levels and then apply the interim fix, following all post-installation instructions carefully.
Alternatively, users can apply Liberty Fix Pack 26.0.0.4 or later, which is targeted for availability in the second quarter of 2026.
No workarounds or other mitigations are provided.