PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-14980 IBM CVE debrief

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled. This vulnerability affects Liberty deployments with the collectiveController-1.0 feature enabled, potentially allowing attackers to elevate privileges through SSRF attacks. Defenders should assess potential exposure and prioritize verification and patching.

Vendor
IBM
Product
WebSphere Application Server - Liberty
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-10-23
Advisory published
2026-07-30
Advisory updated
2026-10-23

Who should care

Defenders responsible for IBM WebSphere Application Server - Liberty deployments, particularly those with the collectiveController-1.0 feature enabled, should assess potential exposure and prioritize verification and patching.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact of the cross-site request forgery vulnerability in IBM WebSphere Application Server - Liberty, particularly in systems with the collectiveController-1.0 feature enabled, and take action to patch or update affected systems.

  • Potential elevation of privileges through SSRF attacks
  • Possible disruption of service through cross-site request forgery
  • Need for verification of exposure and impact
  • Priority for patching and updating affected systems

Technical summary

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled. The vulnerability is related to the collectiveController-1.0 feature and could allow attackers to perform SSRF attacks with elevated privileges.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems with the collectiveController-1.0 feature enabled.

Recommended defensive actions

  • Verify if the collectiveController-1.0 feature is enabled on affected systems
  • Assess potential exposure to cross-site request forgery attacks
  • Review and apply vendor-provided patches or updates

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. Evidence is limited to CVE and NVD information. Defenders should verify exposure and assess potential impact based on available information. The vulnerability is confirmed in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 with the collectiveController-1.0 feature enabled.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-14980 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-14980

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-14980 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-14980

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.