CVE-2026-14446

🗓️ 28 Jul 2026 20:52:17Reported by ibmType

IBM WebSphere Application Server 9.0 and 8.5 have broken access control enabling privilege escalation in the administrative console.

Reporter	Title	Published	Views	Family All 23
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)	10 Aug 202611:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server, which impacts IBM Tivoli Netcool Configuration Manager	24 Aug 202614:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a privilege escalation (CVE-2026-14446)	4 Aug 202616:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by a privilege escalation (CVE-2026-14446)	4 Aug 202616:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase	27 Aug 202606:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities within WebSphere Application Server, affect IBM Tivoli Monitoring.	4 Sep 202623:57	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2026-14446)	27 Aug 202601:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Remote Server, is affected by a privilege escalation (CVE-2026-14446)	18 Aug 202621:16	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14446)	3 Aug 202619:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed WebSphere Application Server is affected by a privilege escalation (CVE-2026-14446)	5 Aug 202619:26	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange8.5.0.0–8.5.5.30

ibm websphere_application_serverRange9.0.0.0–9.0.5.28

[
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server",
    "versions": [
      {
        "status": "affected",
        "version": "9.0"
      },
      {
        "status": "affected",
        "version": "8.5"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7281631

05 Aug 2026 16:26Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.8

EPSS0.00332

SSVC

CWE-306