CVE-2026-14525: IBM WebSphere Application Server Liberty is affected by an authenication bypass
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.9 - Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Patch DT496165 - Compensating control
Verify whether rtcomm-1.0 or rtcommGateway-1.0 features are enabled in IBM WebSphere Application Server Liberty (refer to IBM support page “How to determine if Liberty is using a specific feature” / node 6553910), and only apply the interim fix/fix pack after identifying feature usage.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14525?
The severity of CVE-2026-14525 is critical, with a CVSS score of 9.4.
How do I fix CVE-2026-14525?
To fix CVE-2026-14525, ensure that the rtcomm-1.0 or rtcommGateway-1.0 feature is disabled in IBM WebSphere Application Server Liberty.
What versions of IBM WebSphere Application Server Liberty are affected by CVE-2026-14525?
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 are affected by CVE-2026-14525.
What type of vulnerability is CVE-2026-14525?
CVE-2026-14525 is classified as an authentication bypass vulnerability.
What impact does CVE-2026-14525 have on the security of my application?
CVE-2026-14525 allows unauthorized access to the application, potentially compromising sensitive data.