CVE-2026-14532
MediumCVSS 4.3Summary
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
Risk Assessment
Risk of version information disclosure that could aid an attacker in targeted attacks, and potential application disruption due to uncaught exception.
Recommendation
Apply security fixes from IBM or restrict access to resources for Reader-role users.
Other vulnerabilities in IBM WebSphere Application Server Liberty
See all- CVE-2026-95696Medium
IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception. An attacker could exploit this to make the service unavailable.
- CVE-2026-95695High
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
- CVE-2026-93905High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances. The vulnerability can be exploited without authentication, increasing the risk.
- CVE-2026-79715Medium
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.
- CVE-2026-77816Medium
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
- CVE-2026-14909Medium
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enabled.
- CVE-2026-11713Medium
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.9 are affected by a privilege escalation vulnerability when the restConnector-2.0 feature is enabled.
- CVE-2026-105443High
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install. This could lead to unauthorized access or security breaches between applications.
- CVE-2026-3621High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.4 is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.
- CVE-2026-93909Critical
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
Original NVD description (English source)
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS