PT-2026-65867 · Ibm · Ibm Websphere Application Server+1

CVE-2026-14529

·

Published

2026-07-29

·

Updated

2026-09-05

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5 IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8
Description Server-side request forgery (SSRF) is possible when the SIP container feature sipServlet-1.1 is enabled. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.
Recommendations As a temporary mitigation, disable the sipServlet-1.1 SIP container feature. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Missing Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-14529

Affected Products

Ibm Websphere Application Server
Ibm Websphere Application Server Liberty