IBM has disclosed a CVSS 9.8 unsafe deserialization vulnerability in WebSphere Application Server 9.0 and 8.5 traditional that, per IBM's advisory, could allow an unauthenticated remote attacker to bypass authentication or execute arbitrary code.
What Is It
CVE-2026-14512 is a pre-authentication unsafe deserialization vulnerability (CWE-502) in IBM WebSphere Application Server. According to IBM's advisory, the flaw "could allow a remote attacker to bypass authentication or execute arbitrary code."
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability metric is at its worst value: network-reachable, low attack complexity, no privileges required, and no user interaction. Impact is high across confidentiality, integrity, and availability, giving an exploitability subscore of 3.9 and an impact subscore of 5.9.
The CVE was published 2026-07-28 by IBM PSIRT and currently carries NVD status "Received," meaning the record has not yet completed NVD analysis.
Why It Matters
Deserialization bugs that trigger before authentication remove the last barrier between an internet-facing listener and code execution. With PR:N and UI:N, there is no credential requirement and nothing for a user to click; if the vulnerability behaves as the scoring describes, reaching the service would be sufficient.
WebSphere traditional is common in long-lived enterprise middleware tiers, where it frequently fronts business logic and backend data stores. An authentication bypass on that tier would offer a direct path to whatever sits behind it.
There is no CISA KEV entry for CVE-2026-14512 in the supplied source material, so active exploitation is not confirmed at this time.
What's Vulnerable
Per IBM's affected-product data:
- IBM WebSphere Application Server 9.0 (including 9.0.0)
- IBM WebSphere Application Server 8.5 (including 8.5.0)
Both are the "traditional" editions as described in the CVE text. No other IBM products are listed as affected in the supplied record.
Patch Status
The supplied NVD record cites a single IBM support reference (node 7281649) as the vendor source for this CVE. No fixed version numbers, mitigation steps, or required-action deadlines are included in the supplied data; consult the IBM advisory directly for remediation guidance and confirm your WebSphere build level against it.
No CISA KEV due date applies, as there is no KEV entry in the supplied material.
Sources
- NVD, CVE-2026-14512: https://nvd.nist.gov/vuln/detail/CVE-2026-14512
- IBM Support Advisory ([email protected]): https://www.ibm.com/support/pages/node/7281649