What is the CVSS score of CVE-2026-14529?

CVE-2026-14529 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere are affected by CVE-2026-14529?

IBM WebSphere Application Server (versions 8.5, 9.0, and Liberty 17.0.0.3-26.0.0.8) contains a critical server-side request forgery flaw exploitable by remote, unauthenticated attackers when the SIP…. A patch is available.

How to fix or mitigate CVE-2026-14529?

Within 24 hours, identify all IBM WebSphere Application Server deployments in your environment and determine which have the SIP servlet feature (sipServlet-1.1) enabled-these systems are at immediate risk and should be prioritized for remediation. Within 7 days, deploy the vendor-released patch referenced in IBM advisory node/7281721 to all affected systems: WebSphere Application Server traditional versions 8.5 and 9.0, and WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8. Within 30 days, complete patching across your entire WebSphere estate, verify patch deployment through configuration audits, and implement detection controls to identify any exploitation attempts leveraging SSRF payloads against internal services.

IBM WebSphere CVE-2026-14529

EUVD-2026-50447 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-29 ibm

GHSA-545h-jr28-6wfq

Authentication Bypass SSRF IBM Websphere Application Server Websphere Application Server Liberty

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.6 HIGH

Network-reachable, unauthenticated, low-complexity when SIP feature is enabled, so AV:N/AC:L/PR:N; SSRF strongly enables confidentiality (C:H) but integrity/availability impact is secondary and less certain (I:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 14:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 14:23 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 14:23 NVD

9.4 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

Jul 29, 2026 - 18:52 vuln.today

CVE Published

Jul 29, 2026 - 18:15 cve.org

CRITICAL 9.4

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

AnalysisAI

Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.8) lets remote unauthenticated attackers coerce the server into issuing arbitrary requests when the SIP container feature (sipServlet-1.1) is enabled. The flaw carries a CVSS 9.8 rating with total technical impact, and IBM has released a fix (advisory node/7281721); no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.33%.

Technical ContextAI

The vulnerability lives in the SIP (Session Initiation Protocol) servlet container defined by JSR 289 / sipServlet-1.1, a Java EE feature WebSphere provides for building SIP-based communications applications (VoIP, presence, instant messaging signaling). The root cause is CWE-306 (Missing Authentication for a Critical Function) as classified, manifesting as an SSRF condition: the SIP container processes attacker-influenced request data and initiates network connections without adequately validating or authenticating the request target. Per the CPE data, both affected products are the IBM WebSphere line - cpe:2.3:a:ibm:websphere_application_server and cpe:2.3:a:ibm:websphere_application_server_-_liberty - meaning both the traditional profile and the lightweight Liberty runtime share the vulnerable SIP feature code path.

RemediationAI

Apply the IBM-provided fix documented in the vendor advisory at https://www.ibm.com/support/pages/node/7281721 (Patch available per vendor advisory); consult that page for the exact interim fix / fix pack level for your specific traditional 9.0, 8.5, or Liberty release, as an exact fix version is not enumerated in the available data - do not apply an unverified version number. As the primary compensating control until patching, disable the SIP container feature by removing sipServlet-1.1 from the Liberty server.xml featureManager (or disabling the SIP container in the traditional profile) if your applications do not require SIP signaling - this fully removes the attack surface but will break any deployed SIP servlet applications, so verify no VoIP/presence workloads depend on it first. Where the feature must remain enabled, restrict network reachability of the SIP listener ports to trusted signaling peers via firewall/segmentation and place egress controls on the server so any SSRF-induced outbound requests cannot reach sensitive internal services or metadata endpoints; the trade-off is added network-management overhead and potential disruption to legitimate SIP peers if allowlists are too narrow.