What is the CVSS score of CVE-2026-14976?

CVE-2026-14976 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WebSphere Liberty are affected by CVE-2026-14976?

IBM WebSphere Application Server Liberty with the collectiveController-1.0 feature is vulnerable to unauthenticated remote code execution, allowing any network attacker to execute arbitrary code…. A patch is available.

How to fix or mitigate CVE-2026-14976?

Within 24 hours, inventory all systems running IBM WebSphere Liberty with the collectiveController-1.0 feature and immediately disable the feature or restrict network access to collective controller ports while preparing for patching. Within 7 days, apply the vendor-released patch from IBM to upgrade Liberty to a patched version per the security advisory. Within 30 days, complete testing and validation across all production environments, restore feature functionality if needed post-remediation, and implement network segmentation to restrict collective controller access to authorized administrative hosts only.

WebSphere Liberty CVE-2026-14976

EUVD-2026-50030 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-28 ibm

GHSA-9c23-pjxh-grqq

Authentication Bypass IBM RCE Websphere Application Server Liberty

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable controller with missing authentication (CWE-306) gives unauthenticated RCE (PR:N, AC:L); feature-enablement is a deployment precondition, not an attack-time hurdle, and impact is total (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 16:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 16:07 vuln.today

cvss_changed

Severity Changed

Aug 05, 2026 - 16:07 NVD

HIGH CRITICAL

CVSS changed

Aug 05, 2026 - 16:07 NVD

7.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 28, 2026 - 21:02 vuln.today

CVE Published

Jul 28, 2026 - 20:29 cve.org

HIGH 7.1

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.

AnalysisAI

Remote code execution in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows unauthenticated network attackers to execute arbitrary code when the collectiveController-1.0 feature is enabled. Rooted in a missing-authentication weakness (CWE-306) on collective controller management functions, the flaw carries a 9.8 CVSS score and total technical impact per CISA's SSVC framework. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach collective controller endpoint over network

Delivery

Send crafted request to unauthenticated management function

Exploit

Bypass missing authentication (CWE-306)

Execution

Invoke collective operation to run code

Impact

Execute arbitrary code on controller/members

Access

Reach collective controller endpoint over network

Delivery

Send crafted request to unauthenticated management function

Exploit

Bypass missing authentication (CWE-306)

Execution

Invoke collective operation to run code

Impact

Execute arbitrary code on controller/members

Vulnerability AssessmentAI

Exploitation	Exploitation requires the target Liberty server to have the collectiveController-1.0 feature explicitly enabled in its configuration (server.xml) and its collective controller management endpoint to be network-reachable by the attacker; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed once that feature is present. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are consistent in severity but mixed on urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach a Liberty collective controller's management endpoint over the network sends a crafted request to a controller function that fails to enforce authentication, and - because the collective controller can push and run operations across the collective - leverages it to execute arbitrary code on the controller or managed members. No credentials, user interaction, or local access are required (AV:N/AC:L/PR:N/UI:N). …
Remediation	Patch available per vendor advisory: apply the IBM-provided fix documented at https://www.ibm.com/support/pages/node/7281633, which lists the corrected Liberty fix pack / interim fix for your version stream (apply the version specified there for your 17.0.0.3-26.0.0.8 deployment; exact fix-pack level is defined in the advisory rather than in this dataset). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running IBM WebSphere Liberty with the collectiveController-1.0 feature and immediately disable the feature or restrict network access to collective controller ports while preparing for patching. …

Threat intelligence, references, and detailed analysis are available after sign-in.