What is the CVSS score of CVE-2026-14980?

CVE-2026-14980 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WebSphere Liberty are affected by CVE-2026-14980?

IBM WebSphere Application Server Liberty versions 17.0.0.3-26.0.0.8 contain a CSRF vulnerability enabling authenticated administrator accounts to be hijacked via social engineering, potentially…. A patch is available.

How to fix or mitigate CVE-2026-14980?

Within 24 hours, identify all WebSphere Liberty instances running versions 17.0.0.3 through 26.0.0.8 with collectiveController-1.0 feature enabled by reviewing deployment inventory and server configurations. Within 7 days, apply the vendor-released patch to all affected servers, beginning with production environments. Within 30 days, complete remediation across all non-production instances and verify patch installation by confirming upgraded version numbers in server logs or administrative consoles.

WebSphere Liberty CVE-2026-14980

EUVD-2026-51139 HIGH

Improper Privilege Management (CWE-269)

2026-07-30 ibm

GHSA-78m2-w26r-hcp9

Privilege Escalation CSRF SSRF IBM Websphere Application Server Liberty

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

SSRF extends impact beyond Liberty to internal systems, warranting S:C; all other metrics align with network CSRF requiring no attacker privileges but mandatory victim interaction.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 15:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 15:38 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 15:38 NVD

8.3 (HIGH) 8.8 (HIGH)

Analysis Generated

Jul 30, 2026 - 15:25 vuln.today

CVE Published

Jul 30, 2026 - 14:09 nvd

HIGH 8.3

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.

AnalysisAI

Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.

Technical ContextAI

IBM WebSphere Application Server Liberty is a lightweight, modular Java EE/Jakarta EE application server. The collectiveController-1.0 feature enables collective management - a Liberty-specific capability that allows one server (the collective controller) to orchestrate a cluster of member servers. The root cause is CWE-269 (Improper Privilege Management): the collective controller endpoint processes incoming requests without sufficient verification of their origin, allowing CSRF payloads to execute with the authenticated session's elevated privileges. Because the collective controller can initiate server-to-server communication, a forged request can be weaponised as SSRF, causing the Liberty process to make outbound HTTP/HTTPS requests to internal hosts on the attacker's behalf. The CPE string (cpe:2.3:a:ibm:websphere_application_server_-_liberty) covers the full Liberty product line across all platforms.

RemediationAI

IBM has released a patch addressing this vulnerability; upgrade to the fixed version documented in the IBM support page at https://www.ibm.com/support/pages/node/7281651 (exact fix version not independently specified in available data beyond the advisory reference). As a compensating control prior to patching, disable the collectiveController-1.0 feature in server.xml if collective management is not operationally required - removing the feature entirely eliminates the vulnerable attack surface with no functional impact on non-collective Liberty instances. If collective management must remain active, restrict administrative session exposure by enforcing short session timeouts, deploying anti-CSRF tokens at the network perimeter (e.g., via a WAF rule for the collective controller endpoint), and blocking unauthenticated external access to Liberty management ports. Educate administrators to avoid browsing untrusted sites while holding active Liberty management sessions.