CVE-2026-14976
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
Risk Assessment
An attacker can remotely execute arbitrary code on the server, potentially leading to full system compromise and breach of all security aspects.
Recommendation
Disable the collectiveController-1.0 feature if not needed, or upgrade Liberty to a version containing the fix.
Other vulnerabilities in IBM WebSphere Application Server - Liberty
See all- CVE-2026-3621High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.4 is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.
- CVE-2026-14525Critical
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
- CVE-2026-10571Medium
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.
- CVE-2026-18499High
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.
- CVE-2026-14980High
IBM WebSphere Application Server Liberty is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.
- CVE-2026-11897High
IBM WebSphere Application Server Liberty is vulnerable to a denial of service (DoS) attack via a specially crafted request that causes excessive memory consumption.
- CVE-2026-2482Low
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 are vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to execute unauthorized actions on behalf of a trusted user.
- CVE-2026-15280High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 ND Collective Controller is vulnerable to a path-segment injection vulnerability in the collective routing mechanism.
- CVE-2026-15057High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.
- CVE-2026-16192High
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.
Original NVD description (English source)
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.