What is the CVSS score of CVE-2026-14976?

CVE-2026-14976 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WebSphere Liberty are affected by CVE-2026-14976?

IBM WebSphere Application Server Liberty with the collectiveController-1.0 feature is vulnerable to unauthenticated remote code execution, allowing any network attacker to execute arbitrary code…. A patch is available.

How to fix or mitigate CVE-2026-14976?

Within 24 hours, inventory all systems running IBM WebSphere Liberty with the collectiveController-1.0 feature and immediately disable the feature or restrict network access to collective controller ports while preparing for patching. Within 7 days, apply the vendor-released patch from IBM to upgrade Liberty to a patched version per the security advisory. Within 30 days, complete testing and validation across all production environments, restore feature functionality if needed post-remediation, and implement network segmentation to restrict collective controller access to authorized administrative hosts only.

WebSphere Liberty CVE-2026-14976

EUVD-2026-50030 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-28 ibm

GHSA-9c23-pjxh-grqq

Authentication Bypass RCE IBM Websphere Application Server Liberty

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable controller with missing authentication (CWE-306) gives unauthenticated RCE (PR:N, AC:L); feature-enablement is a deployment precondition, not an attack-time hurdle, and impact is total (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 16:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 16:07 vuln.today

cvss_changed

Severity Changed

Aug 05, 2026 - 16:07 NVD

HIGH CRITICAL

CVSS changed

Aug 05, 2026 - 16:07 NVD

7.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 28, 2026 - 21:02 vuln.today

CVE Published

Jul 28, 2026 - 20:29 cve.org

HIGH 7.1

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.

AnalysisAI

Remote code execution in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows unauthenticated network attackers to execute arbitrary code when the collectiveController-1.0 feature is enabled. Rooted in a missing-authentication weakness (CWE-306) on collective controller management functions, the flaw carries a 9.8 CVSS score and total technical impact per CISA's SSVC framework. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), but the network-reachable, unauthenticated nature makes it a high-priority patch where the collective feature is in use.

Technical ContextAI

WebSphere Liberty is IBM's lightweight, modular Java/Jakarta EE application server whose capabilities are activated through named features in server.xml. The vulnerable component is the collectiveController-1.0 feature, which turns a Liberty instance into a collective controller - the central management node that administers a cluster ('collective') of Liberty member servers, exposing administrative and orchestration endpoints. The CWE-306 (Missing Authentication for a Critical Function) root cause means a security-critical management operation on the controller can be reached without the caller proving identity, and because that operation can drive code execution across managed nodes, the impact escalates to full RCE. The single affected CPE is cpe:2.3:a:ibm:websphere_application_server_-_liberty, spanning the entire 17.0.0.3-26.0.0.8 range, indicating a long-standing defect in the collective controller code path rather than a recent regression.

RemediationAI

Patch available per vendor advisory: apply the IBM-provided fix documented at https://www.ibm.com/support/pages/node/7281633, which lists the corrected Liberty fix pack / interim fix for your version stream (apply the version specified there for your 17.0.0.3-26.0.0.8 deployment; exact fix-pack level is defined in the advisory rather than in this dataset). As an immediate compensating control until patching, disable the collectiveController-1.0 feature in server.xml on any controller that does not strictly require it - this removes the vulnerable code path entirely, at the cost of losing centralized collective management for that node. Where the feature must remain enabled, restrict network access to the collective controller's administrative ports so they are reachable only from trusted management networks or via firewall/allowlist rules, accepting that this narrows but does not eliminate exposure. Verify remediation against the vendor advisory and VulDB entry (https://vuldb.com/vuln/383995).