IBM WebSphere Liberty CSRF and Privilege Escalation Vulnerability Advisory (CVE-2026-14980, CVE-2026-2482)

IBM WebSphere Application Server Liberty Cross-Site Request Forgery Vulnerability (CVE-2026-14980, CVE-2026-2482) Vulnerability Overview IBM WebSphere Application Server Liberty contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to execute malicious and unauthorized operations when the feature is enabled. Vulnerability Details CVE-2026-14980 - Description: IBM WebSphere Application Server Liberty contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to perform SSRF attacks and elevate privileges when the feature is enabled. - CWE: CWE-269: Improper Privilege Management - CVSS Source: IBM - CVSS Base Score: 8.3 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) CVE-2026-2482 - Description: IBM WebSphere Application Server Liberty contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to execute malicious and unauthorized operations from trusted websites. - CWE: CWE-352: Cross-Site Request Forgery (CSRF) - CVSS Source: IBM - CVSS Base Score: 3.1 - CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Affected Products Affected Product: IBM WebSphere Application Server - Liberty Affected Versions: 17.0.0.3 - 26.0.0.8 Remediation IBM strongly recommends resolving this vulnerability immediately by applying available workarounds or fix packs, which include fixes for APAR PH71678. To determine if the feature is enabled, refer to How to determine if Liberty is using a specific feature. Specific Steps 1. Upgrade IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.8 to the required minimum fix pack level, then apply the workaround for PH71678. 2. Alternatively, apply Liberty Fix Pack 26.0.0.9 or higher (Target Availability: Q3 2026). Additional workarounds may be available and are linked to the workaround download page. Additional Information Workarounds and Mitigations: None Reference Links: - Complete CVSS v3 Guide - On-line Calculator v3 - How to determine if Liberty is using a specific feature Related Resources IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Change History July 28, 2026: Initial release Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry-open standard intended to convey vulnerability severity and help to determine response urgency and priority." IBM provides CVSS scores "as is" without any express or implied warranties, including the implied warranties of merchantability and fitness for a particular purpose. Customers are responsible for evaluating the impact of any actual or potential security vulnerabilities. IBM regularly updates records of components included in its product portfolio. Furthermore, to address potential vulnerabilities, IBM identifies CVE dates in packages in its product/service inventory that were previously unidentified. The inclusion of older CVE dates does not indicate that the referenced product has been used by IBM since that date, nor does it indicate that IBM was aware of the vulnerability prior to that date. We are working to inform customers of vulnerabilities that we are aware of. The referenced "Affected Products and Versions" are intended to include only products and versions that are supported by IBM and have not passed their end-of-support or end-of-warranty dates. Therefore, referencing unsupported or extended support products and versions in this security bulletin does not constitute an IBM determination that the vulnerability does not affect them. Referencing one or more unsupported versions in this security bulletin does not impose an obligation on IBM to provide fixes for any unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere Liberty CSRF and Privilege Escalation Vulnerability Advisory (CVE-2026-14980, CVE-2026-2482)

More from this source