What is the CVSS score of CVE-2026-14528?

CVE-2026-14528 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of WebSphere Application Server are affected by CVE-2026-14528?

IBM WebSphere Application Server versions 8.5 and 9.0 contain a remote information disclosure vulnerability (CVE-2026-14528) that allows attackers to access sensitive data logged by the application…. A patch is available.

How to fix or mitigate CVE-2026-14528?

Within 24 hours, inventory all systems running IBM WebSphere Application Server 8.5 or 9.0 Traditional and document the sensitive information captured in diagnostic logs and application logs. Within 7 days, contact IBM support to obtain the available patch and deploy it to all affected production systems. Within 30 days, verify patch deployment across all remaining systems and audit pre-patch logs for indicators of unauthorized information access.

WebSphere Application Server CVE-2026-14528

EUVD-2026-50059 HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2026-07-28 ibm

GHSA-8h99-w74c-wm2r

IBM Information Disclosure Websphere Application Server

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible log disclosure with no auth barrier per vendor; confidentiality-only impact aligns with CWE-532 scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 16:16 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 16:07 vuln.today

cvss_changed

CVSS changed

Aug 05, 2026 - 16:07 NVD

7.4 (HIGH) 7.5 (HIGH)

Analysis Generated

Jul 28, 2026 - 21:22 vuln.today

CVE Published

Jul 28, 2026 - 20:37 nvd

HIGH 7.4

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.

AnalysisAI

Sensitive information disclosure in IBM WebSphere Application Server 8.5 and 9.0 Traditional allows a remote, unauthenticated attacker to obtain confidential data, assessed by IBM as a High-severity issue (CVSS 7.5). The root cause is CWE-532, indicating that sensitive information is inserted into log files or diagnostic output in a manner accessible to remote actors. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the CVSS vector attributes high confidentiality impact, and a vendor-released patch is available via IBM support.

Technical ContextAI

CWE-532 (Insertion of Sensitive Information into Log File) describes a class of vulnerability where an application logs data that should remain confidential - credentials, session tokens, API keys, or personally identifiable information - in locations or formats accessible beyond the intended audience. In IBM WebSphere Application Server (CPE: cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*), the 'traditional' deployment mode of versions 8.5 and 9.0 is specifically affected, distinguishing this from the Liberty profile variants. WebSphere is a Java EE/Jakarta EE application server with extensive logging infrastructure (SystemOut.log, trace.log, FFDC) that can capture request/response context, JNDI credentials, LTPA tokens, and administrative operations. If such logs are reachable remotely - via the administrative console, an exposed log streaming endpoint, or a misconfigured HTTP path - an unauthenticated remote attacker could harvest the logged sensitive data.

RemediationAI

Apply the vendor-released patch documented in the IBM support advisory at https://www.ibm.com/support/pages/node/7281649. IBM has confirmed a fix is available, but the exact patched fixpack or iFix version number is not specified in available intelligence - review the advisory directly to identify the precise target version for your 8.5 or 9.0 Traditional installation. As an interim compensating control, restrict access to WebSphere log directories and administrative endpoints at the network layer: block external access to the WebSphere administrative console ports (default 9060/9043) and any log streaming endpoints via firewall or reverse proxy ACLs. Additionally, reduce log verbosity and disable trace logging in production to minimize the volume of sensitive data written to logs. Note that disabling trace logging may hinder future diagnostics. Rotate any credentials, LTPA tokens, or API keys that may have been written to logs prior to patching, as those values should be considered potentially compromised.