CVE-2026-14529

Analyzed Analyzed - Analysis Complete

SSRF in IBM WebSphere Application Server

Publication date: 2026-07-29

Last updated on: 2026-08-04

Assigner: IBM Corporation

Description

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-14529

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server	From 9.0.0.0 (inc) to 9.0.5.29 (exc)
ibm	websphere_application_server	From 8.5.0.0 (inc) to 8.5.5.31 (exc)
ibm	websphere_application_server	From 17.0.0.3 (inc) to 26.0.0.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a server-side request forgery (SSRF) vulnerability in IBM WebSphere Application Server versions 9.0, 8.5, and Liberty 17.0.0.3 through 26.0.0.8. It occurs when the SIP container feature (sipServlet-1.1) is enabled, allowing attackers to send unauthorized requests from the server to internal systems.

Detection Guidance

To detect this SSRF vulnerability in IBM WebSphere Application Server, check if the SIP container feature (sipServlet-1.1) is enabled. Review server configurations for the presence of this feature. Monitor network traffic for unusual outbound requests originating from the server.

Impact Analysis

An attacker could exploit this to access internal systems, steal sensitive data, or perform unauthorized actions on behalf of the server. This could lead to data breaches, service disruption, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (healthcare data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Disable the SIP container feature (sipServlet-1.1) if enabled on IBM WebSphere Application Server 9.0, 8.5, or Liberty 17.0.0.3 through 26.0.0.8 to prevent SSRF attacks.

Hi! I’m here to help you understand CVE-2026-14529. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70