What is the CVSS score of CVE-2026-14525?

CVE-2026-14525 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.6%.

Which versions of WebSphere Liberty are affected by CVE-2026-14525?

IBM WebSphere Application Server Liberty (versions 17.0.0.3-26.0.0.8) contains a critical unauthenticated authentication bypass that allows remote attackers to access protected real-time…. A patch is available.

How to fix or mitigate CVE-2026-14525?

Within 24 hours, conduct inventory of all IBM WebSphere Application Server Liberty deployments to identify instances running versions 17.0.0.3 through 26.0.0.8 with rtcomm-1.0 or rtcommGateway-1.0 features enabled; isolate or restrict network access to critical systems pending patch deployment. Within 7 days, apply the available vendor patch to all affected Liberty instances, or temporarily disable rtcomm-1.0 and rtcommGateway-1.0 features if patching cannot complete within this window. Within 30 days, complete patch deployment across all infrastructure, verify no instances remain on vulnerable versions, and review access logs for indicators of unauthorized access to real-time communication functions.

WebSphere Liberty CVE-2026-14525

EUVD-2026-58362 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-13 ibm

GHSA-fpr6-jmjm-9r5g

Authentication Bypass IBM Websphere Application Server Liberty

9.4

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

9.4 CRITICAL

Missing authentication on a network-reachable Rtcomm function gives unauthenticated remote access (PR:N/AV:N/AC:L) with high confidentiality/integrity and limited availability impact; feature-enablement is treated as environmental, not AC.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:38 vuln.today

CVE Published

Aug 13, 2026 - 19:37 nvd

CRITICAL 9.4

DescriptionCVE.org

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.

AnalysisAI

Authentication bypass in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows remote attackers to circumvent authentication controls when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled, exposing protected real-time communication functions. The CVSS 3.1 base score is 9.4 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:L), reflecting high confidentiality and integrity impact reachable over the network without credentials. A vendor patch is available; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

IBM WebSphere Liberty is a lightweight, feature-provisioned Java application server where capabilities are enabled selectively via named features in server.xml. The rtcomm-1.0 and rtcommGateway-1.0 features implement Rtcomm, IBM's WebRTC-based real-time communication and signaling stack (used for browser-to-browser voice/video/data and MQTT-brokered gateway signaling). The root cause is classified as CWE-306 (Missing Authentication for Critical Function): when these features are provisioned, a security-sensitive function is exposed without properly enforcing authentication, so requests that should require an authenticated identity are honored anonymously. The affected CPE is cpe:2.3:a:ibm:websphere_application_server_-_liberty, confirming the Liberty profile (not traditional/full WebSphere ND) as the affected product line.

RemediationAI

Apply the IBM-provided fix per the advisory at https://www.ibm.com/support/pages/node/7283488 (Patch available per vendor advisory); consult that page for the exact interim fix / fix pack level for your version, as no specific fixed version string was included in the input data and should not be assumed. As an immediate compensating control until patched, remove the rtcomm-1.0 and rtcommGateway-1.0 features from server.xml if Rtcomm real-time communications are not required - this fully eliminates the exposed code path with the trade-off of disabling WebRTC signaling/gateway functionality for any application that depends on it. Where the feature must remain enabled, restrict network access to the Rtcomm signaling endpoints via firewall/reverse-proxy allow-listing and place the server behind an authenticating proxy, accepting the operational overhead and that this is a mitigation rather than a fix. Prioritize patching over configuration changes since the underlying missing-authentication defect persists until the fix is applied.