What is the CVSS score of CVE-2026-14525?

CVE-2026-14525 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.6%.

Which versions of WebSphere Liberty are affected by CVE-2026-14525?

IBM WebSphere Application Server Liberty (versions 17.0.0.3-26.0.0.8) contains a critical unauthenticated authentication bypass that allows remote attackers to access protected real-time…. A patch is available.

How to fix or mitigate CVE-2026-14525?

Within 24 hours, conduct inventory of all IBM WebSphere Application Server Liberty deployments to identify instances running versions 17.0.0.3 through 26.0.0.8 with rtcomm-1.0 or rtcommGateway-1.0 features enabled; isolate or restrict network access to critical systems pending patch deployment. Within 7 days, apply the available vendor patch to all affected Liberty instances, or temporarily disable rtcomm-1.0 and rtcommGateway-1.0 features if patching cannot complete within this window. Within 30 days, complete patch deployment across all infrastructure, verify no instances remain on vulnerable versions, and review access logs for indicators of unauthorized access to real-time communication functions.

WebSphere Liberty CVE-2026-14525

EUVD-2026-58362 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-13 ibm

GHSA-fpr6-jmjm-9r5g

Authentication Bypass IBM Websphere Application Server Liberty

9.4

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

9.4 CRITICAL

Missing authentication on a network-reachable Rtcomm function gives unauthenticated remote access (PR:N/AV:N/AC:L) with high confidentiality/integrity and limited availability impact; feature-enablement is treated as environmental, not AC.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:38 vuln.today

CVE Published

Aug 13, 2026 - 19:37 nvd

CRITICAL 9.4

DescriptionCVE.org

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.

AnalysisAI

Authentication bypass in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows remote attackers to circumvent authentication controls when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled, exposing protected real-time communication functions. The CVSS 3.1 base score is 9.4 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:L), reflecting high confidentiality and integrity impact reachable over the network without credentials. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach Liberty Rtcomm endpoint over network

Delivery

Send request to rtcomm signaling function

Exploit

Bypass missing authentication check

Execution

Access protected real-time comm functions

Impact

Read sensitive data and alter integrity