WebSphere Application Server CVE-2026-14528

Exploitation requires that the target is running IBM WebSphere Application Server 8.5 or 9.0 in 'Traditional' mode specifically - the Liberty profile is not confirmed affected. The CVSS vector (PR:N) indicates no authentication is required to trigger the vulnerability, but actual retrieval of the logged sensitive information depends on the attacker being able to reach the log output - whether via an exposed administrative console, a log streaming interface, or another remotely accessible path. The SSVC 'Automatable: no' designation suggests that despite the low-complexity CVSS rating, exploitation is not fully scriptable without knowledge of the target's specific log configuration and exposure surface. Exploitation is limited to the confidentiality dimension: there is no integrity or availability impact. Non-default exposure of log endpoints would increase exploitability; environments with hardened perimeter controls blocking access to administrative ports significantly reduce the realistic attack surface.

The CVSS 7.5 High score is driven by AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, suggesting unauthenticated, low-complexity remote exploitation with high confidentiality impact. However, this signal should be weighted against competing indicators. EPSS is only 0.26% (17th percentile), placing this well below the threshold of observed exploitation activity in the threat landscape. SSVC marks Exploitation as 'none' and Automatable as 'no' - the latter is a notable contradiction with the CVSS AC:L/PR:N/UI:N combination, which would ordinarily suggest automation is feasible. This discrepancy likely reflects that exploiting CWE-532 requires contextual knowledge of which log paths are accessible and what sensitive tokens are present, even if no authentication wall exists. SSVC Technical Impact is listed as 'total,' which may reference the full confidentiality exposure if credentials or tokens are harvested. In practice, this is a medium-operational-priority issue: it is not actively exploited (no KEV, low EPSS), but the potential for credential or token harvesting from a widely deployed enterprise platform elevates its remediation urgency above a low-impact finding. Patch availability reduces residual risk if applied promptly.

An unauthenticated remote attacker sends crafted HTTP requests to an exposed WebSphere 9.0 Traditional instance, triggering log entries that capture sensitive request parameters such as authentication tokens or LDAP bind credentials. If the attacker can subsequently retrieve those log contents - through an accessible administrative endpoint, a misconfigured log file path, or an adjacent system with log aggregation access - they extract the sensitive material and use it to authenticate to downstream systems. No public exploit code exists at time of analysis, so exploitation currently requires targeted research into the specific log exposure vector for a given deployment.