What is the CVSS score of CVE-2026-14974?

CVE-2026-14974 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM WebSphere are affected by CVE-2026-14974?

A critical vulnerability in WebSphere Application Server 8.5 and 9.0 (CVE-2026-14974) enables unauthenticated remote code execution with no user interaction required, affecting enterprises running…. A patch is available.

How to fix or mitigate CVE-2026-14974?

Within 24 hours, conduct an urgent inventory of all WebSphere Application Server 8.5 and 9.0 instances and immediately disable internet-facing access or restrict network connections to trusted sources only. Within 7 days, test the available vendor patch in a staging environment to validate application compatibility, then deploy to all production systems. Within 30 days, verify patch deployment across your entire WebSphere estate through vulnerability scanning and configuration audits. For systems requiring extended remediation timelines, maintain network-level access controls restricting WebSphere ports until patching is complete.

IBM WebSphere CVE-2026-14974

EUVD-2026-50031 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-28 ibm

GHSA-3943-mgp9-h6fv

RCE Deserialization IBM Websphere Application Server

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization yields RCE with full confidentiality, integrity, and availability impact, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 16:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 16:07 vuln.today

cvss_changed

Severity Changed

Aug 05, 2026 - 16:07 NVD

HIGH CRITICAL

CVSS changed

Aug 05, 2026 - 16:07 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 28, 2026 - 21:04 vuln.today

CVE Published

Jul 28, 2026 - 20:29 cve.org

HIGH 8.1

DescriptionNVD

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

AnalysisAI

Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network attacker to run arbitrary code by sending crafted serialized data that the server deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 rating with a network attack vector and no authentication or user interaction required, though SSVC records exploitation as none observed and no public exploit was identified at time of analysis. EPSS is low at 0.37% (29th percentile), indicating that active, widespread exploitation has not yet materialized despite the maximal technical impact.

Technical ContextAI

The vulnerability lies in Java object deserialization within IBM WebSphere Application Server traditional (the classic profile, distinct from Liberty), an enterprise Java EE application server that processes serialized objects over protocols such as IIOP/RMI and within its management and messaging layers. CWE-502 (Deserialization of Untrusted Data) arises when the server reconstructs Java objects from an attacker-controlled byte stream without restricting the class types instantiated; crafted gadget chains present on the server classpath can then be triggered during the readObject phase to achieve code execution. The affected CPE is cpe:2.3:a:ibm:websphere_application_server, covering versions 8.5 and 9.0 of the traditional edition.

RemediationAI

Apply the vendor fix per IBM's advisory at https://www.ibm.com/support/pages/node/7281641, which provides the interim fix or fix pack addressing the deserialization flaw for WebSphere Application Server traditional 8.5 and 9.0; a patch is available from the vendor, though an exact fix-pack version was not provided in the input data and should be taken directly from IBM's advisory. If patching cannot be immediately scheduled, reduce exposure by restricting network access to the IIOP/ORB (typically TCP 2809 and bootstrap ports) and administrative ports to trusted management hosts only via firewall rules, which limits the reachable deserialization surface but can break legitimate remote EJB/IIOP clients and cross-cell communication. Where WebSphere's deserialization filtering is supported, enable and tighten the serialization allow/deny class filters, accepting that overly strict lists may disrupt applications relying on remote object exchange. Prioritize any WebSphere traditional instances exposed beyond the internal management network.