Loading vulnerability…
Pre-authentication Unsafe Deserialization in IBM WebSphere Application Server Traditional
CVE-2026-14512 is an unsafe deserialization vulnerability in IBM WebSphere Application Server traditional versions 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.30. Deserialization of untrusted data before authentication can allow a remote, unauthenticated attacker to bypass authentication or execute arbitrary code. Exploitation requires no user interaction and has low attack complexity. The vulnerability has a CVSS v3.1 score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The specific vulnerable function and request format are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of an affected WebSphere server through authentication bypass or arbitrary code execution. Potential consequences include unauthorized access to sensitive application data, modification of applications or configurations, deployment of malicious code, and service disruption. The operating-system privileges obtained through code execution are not specified.
If you can’t patch tonight, do this now.
IBM identifies no vulnerability-specific workarounds or mitigations. Pending patching, reduce exposure by restricting access to affected WebSphere services and administrative or management interfaces to trusted networks. Monitor for unusual authentication attempts, unauthorized administrative access, unexpected application deployments or configuration changes, and deserialization-related errors. These measures do not remediate the vulnerability.
Patch, then assume compromise.
Apply the IBM interim fix resolving APAR PH72166, first upgrading to the minimum fix-pack level required by that interim fix if necessary. Alternatively, upgrade WebSphere Application Server traditional 9.0 to Fix Pack 9.0.5.29 or later, or version 8.5 to Fix Pack 8.5.5.31 or later, using a release containing the APAR PH72166 fix. IBM initially targeted these fix packs for availability in the third quarter of 2026. Apply the appropriate WebSphere fix to affected installations embedded in or deployed alongside other products as well.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.