CVE-2026-14980

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8

Description Cross-site request forgery occurs when the collectiveController-1.0 feature is enabled, potentially allowing an attacker to execute Server-Side Request Forgery (SSRF) attacks with elevated privileges. SSRF is a technique where an attacker induces a server-side application to make requests to an unintended location.

Recommendations Disable the collectiveController-1.0 feature as a mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.