CVE-2026-14528

Analyzed Analyzed - Analysis Complete

IBM WebSphere Application Server Information Disclosure Vulnerability

Publication date: 2026-07-28

Last updated on: 2026-08-05

Assigner: IBM Corporation

Description

IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-08-05

Generated

2026-08-18

AI Q&A

2026-07-29

EPSS Evaluated

2026-08-16

NVD

CVE-2026-14528

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server	From 9.0.0.0 (inc) to 9.0.5.29 (exc)
ibm	websphere_application_server	From 8.5.0.0 (inc) to 8.5.5.31 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

IBM WebSphere Application Server 9.0 and 8.5 traditional versions have a vulnerability that allows a remote attacker to access sensitive information. The attack vector is network-based with low attack complexity, requiring no privileges or user interaction.

Detection Guidance

This vulnerability involves IBM WebSphere Application Server 9.0 and 8.5 traditional. Detection requires checking for exposed administrative interfaces or misconfigurations. Use commands like 'curl -v http://[server]:[port]/ibm/console' to test access to the admin console. Verify server version with 'curl -s http://[server]:[port]/' and inspect headers for WebSphere details. Ensure firewalls restrict access to ports like 9043 (HTTPS admin) or 9060 (HTTP admin).

Impact Analysis

This vulnerability could allow unauthorized access to sensitive data, potentially leading to data breaches, information theft, or further exploitation of affected systems. The high impact on confidentiality and integrity suggests significant risk.

Compliance Impact

The vulnerability allows remote attackers to obtain sensitive information, which could lead to unauthorized data access. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Apply the latest security patches or updates provided by IBM for WebSphere Application Server versions 9.0 and 8.5 traditional. Monitor IBM PSIRT advisories for updates and restrict network access to the server if possible.

Hi! I’m here to help you understand CVE-2026-14528. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70