Privilege escalation in IBM WebSphere Application Server administrative console (CVE-2026-14446)

IBM WebSphere Application Server contains a broken access control vulnerability (CWE-306: Missing Authentication for Critical Function) in its administrative console. An unauthenticated remote attacker could exploit this flaw to escalate privileges, with potential for full compromise of confidentiality, integrity, and availability (CVSS 9.8). Affected versions: - 9.0.0.0 through 9.0.5.28 - 8.5.0.0 through 8.5.5.30 We recommend updating to: 9.0.5.29, 8.5.5.31. CVSS 9.8 · our assessment: act_now Reference: https://www.ibm.com/support/pages/node/7281631 Details: https://vuln.today/cve/CVE-2026-14446