Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2026-14512 is a vulnerability classified as Deserialization of Untrusted Data, affecting WebSphere Application Server (affected versions: 9.0 and 8.5). This vulnerability is rated Critical, with a CVSS score of 9.8. Current sources do not report this vulnerability as exploited.
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
IBM WebSphere Application Server traditional is identified by IBM as affected in the following branches:
9.0.0.0 through 9.0.5.28 is affected. IBM lists Fix Pack 9.0.5.29 or later as the fix-pack path, with targeted availability in 3Q2026.8.5.0.0 through 8.5.5.30 is affected. IBM lists Fix Pack 8.5.5.31 or later as the fix-pack path, with targeted availability in 3Q2026.PH72166 is listed for releases 9.0.5.20 through 9.0.5.28 and 8.5.5.25 through 8.5.5.30.5.1, 5.2, and 5.3; Jazz for Service Management 1.1.3.7 through 1.1.3.27; and IBM WebSphere Remote Server 8.5, 9.0, and 9.1, because those products use or bundle affected WebSphere Application Server. Releases or parallel branches not explicitly covered should not be treated as confirmed unaffected.The flaw is in the handling of data that is deserialized by IBM WebSphere Application Server traditional before authentication is completed. Attacker-controlled input can reach this processing path without an account, potentially resulting in authentication bypass or arbitrary code execution. The record establishes network reachability, no required privileges, no user interaction, and low attack complexity. The available evidence does not identify the specific endpoint, serialized object format, Java class, or payload involved. An exact endpoint or exploit chain should therefore not be inferred beyond the documented pre-authentication unsafe deserialization mechanism.
The vulnerability is remotely reachable over the network before authentication, with no prior privileges and no user interaction required. The record characterizes the attack as low complexity, so a suitably crafted request may be sufficient to trigger the vulnerable path when the relevant server interface is exposed. The supplied record marks public_exploit as false, but it does not establish the actual exploitation status. The known-exploited and ransomware-campaign fields are unset, so they do not support a conclusion that exploitation has not occurred.
Successful exploitation could provide unauthorized access through authentication bypass or arbitrary code execution on the WebSphere server. The practical result depends on the server process privileges, configuration, and deployed applications, but may affect application data, application functions, and service availability. The supplied assessment characterizes the potential impact as high across confidentiality, integrity, and availability, but it does not identify a specific operating-system privilege level for executed code. The available evidence does not establish a particular compromise or actual impact scope.
Successful exploitation could let an attacker bypass application authentication or execute code on a WebSphere server. Depending on the process privileges and deployment configuration, this could enable unauthorized access to application functions and data, data modification, or service disruption. The potential consequences span confidentiality, integrity, and availability. The available evidence does not identify a specific compromise, victim, or accessed dataset.
9.0.0.0 through 9.0.5.28, upgrade to the minimum fix pack required by the interim fix and then apply the interim fix that resolves APAR PH72166. IBM lists 9.0.5.20-WS-WAS-IFPH72166 for releases 9.0.5.20 through 9.0.5.28.8.5.0.0 through 8.5.5.30, upgrade to the minimum fix pack required by the interim fix and then apply the interim fix that resolves APAR PH72166. IBM lists 8.5.5.25-WS-WAS-IFPH72166 for releases 8.5.5.25 through 8.5.5.30.9.0.5.29 or later for the 9.0 branch, or Fix Pack 8.5.5.31 or later for the 8.5 branch, subject to IBM's stated targeted availability.PH72166 is addressed on every instance and IBM product that uses WebSphere.PH72166 is installed on every relevant instance.CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
en
