CVE-2026-14909: IBM WebSphere Application Server Liberty Information Disclosure
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.
Other sources
IBM WebSphere Application Server Liberty is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.10
Event History
Frequently Asked Questions
Which Liberty deployments are affected?
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.9 are affected when the restConnector-2.0 feature is enabled.
What access does an attacker need?
An attacker must be authenticated to exploit this issue. The provided vector indicates network access is sufficient, requires low attack complexity, and does not require user interaction.
What is the expected impact?
A successful attacker can obtain sensitive information. The provided severity vector indicates high confidentiality impact, with no integrity or availability impact.