CVE-2026-14528

Received Received - Intake

IBM WebSphere Application Server Information Disclosure Vulnerability

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: IBM Corporation

Description

IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-14528

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server	9.0
ibm	websphere_application_server	8.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

IBM WebSphere Application Server 9.0 and 8.5 traditional versions have a vulnerability that allows a remote attacker to access sensitive information. The attack vector is network-based with low attack complexity, requiring no privileges or user interaction.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive data, potentially leading to data breaches, information theft, or further exploitation of affected systems. The high impact on confidentiality and integrity suggests significant risk.

Compliance Impact

The vulnerability allows remote attackers to obtain sensitive information, which could lead to unauthorized data access. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Apply the latest security patches or updates provided by IBM for WebSphere Application Server versions 9.0 and 8.5 traditional. Monitor IBM PSIRT advisories for updates and restrict network access to the server if possible.

Hi! I’m here to help you understand CVE-2026-14528. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70