CVE-2026-14529
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
An SSRF vulnerability in IBM WebSphere Application Server 9.0, 8.5, and Liberty 17.0.0.3-26.0.0.8 occurs when the SIP container feature (sipServlet-1.1) is enabled. An attacker can use the server to send requests to internal resources.
Risk Assessment
An attacker can perform SSRF attacks, gaining access to internal systems and data, potentially leading to privilege escalation or information disclosure.
Recommendation
Disable the sipServlet-1.1 feature if not required, or apply appropriate firewall rules to restrict access to the server.
Original NVD description (English source)
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.