CVE-2026-14525

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in IBM WebSphere Liberty

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: IBM Corporation

Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-14525

EUVD

EUVD-2026-58362

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server_liberty	From 17.0.0.3 (inc) to 26.0.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 are vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled. This allows unauthorized access to critical functions without proper authentication.

Detection Guidance

To detect this vulnerability, check if the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled in your IBM WebSphere Application Server Liberty installation. Review server configuration files for these features in the enabled features list.

Impact Analysis

An attacker could exploit this to bypass authentication, gain unauthorized access to sensitive data or functions, and potentially execute malicious actions on the affected system. The high CVSS score (9.4) indicates significant risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating compliance requirements for data protection standards like GDPR and HIPAA, which mandate strict access controls and authentication mechanisms.

Mitigation Strategies

Apply the interim fix for APAR DT496165 or upgrade to Liberty Fix Pack 26.0.0.9 or later. If upgrading, verify the fix pack is installed and the vulnerable features are no longer active.

Hi! I’m here to help you understand CVE-2026-14525. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70