CVE-2026-14976

Received Received - Intake

Remote Code Execution in IBM WebSphere Liberty

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: IBM Corporation

Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-14976

EUVD

EUVD-2026-50030

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server_liberty	From 17.0.0.3 (inc) to 26.0.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 have a remote code execution vulnerability when the collectiveController-1.0 feature is enabled. This allows attackers to execute arbitrary code remotely on affected systems.

Detection Guidance

Check if the collectiveController-1.0 feature is enabled in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8. Review server configuration files for the presence of this feature.

Impact Analysis

This vulnerability could allow unauthorized remote attackers to execute malicious code on your system, potentially leading to data breaches, system compromise, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability allows remote code execution, which could lead to unauthorized access to sensitive data. This may violate GDPR's data protection requirements and HIPAA's security rules for protected health information if exploited.

Mitigation Strategies

Disable the collectiveController-1.0 feature if enabled. Update IBM WebSphere Application Server Liberty to a version beyond 26.0.0.8 where the vulnerability is patched.

Hi! I’m here to help you understand CVE-2026-14976. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70