Loading vulnerability…
Sensitive Information Disclosure Through Logging in IBM WebSphere Application Server Traditional
CVE-2026-14528 is a sensitive-information disclosure vulnerability in IBM WebSphere Application Server traditional versions 8.5 and 9.0. Sensitive information is inserted into log files, potentially allowing a remote attacker to obtain that information. The affected release ranges identified for remediation are 8.5.0.0 through 8.5.5.30 and 9.0.0.0 through 9.0.5.28. The specific logging function, exposed information, and access mechanism are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker could obtain sensitive information recorded in application-server logs. The types and extent of information exposed are not specified. Integrity or availability impacts are not independently established for this vulnerability.
If you can’t patch tonight, do this now.
IBM states that no workarounds or mitigations are available for this vulnerability.
Patch, then assume compromise.
Apply the interim fix resolving APAR PH72166 after upgrading to the minimum fix-pack level required by that interim fix. Alternatively, upgrade WebSphere Application Server traditional 9.0 to Fix Pack 9.0.5.29 or later, or version 8.5 to Fix Pack 8.5.5.31 or later. These fix packs had targeted availability in the third quarter of 2026; their actual availability is not established here. Apply an available applicable fix promptly.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.