EXPOSURES › CVE-2026-14529

CVE-2026-14529

CRITICAL

DETAIL

SourceNVD · cve Published2026-07-29 CVSS9.4 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-14529 ↗

SHAME 65/100 unpatchedexploited-in-wild

IBM WebSphere Application Server 9.0, 8.5, and Liberty 17.0.0.3 through 26.0.0.8 with SIP container feature enabled is vulnerable to SSRF.

Server-side request forgery (SSRF) allows attackers to read internal systems or launch attacks from within the network, bypassing perimeter defenses. DIB orgs must patch WebSphere and disable the SIP container feature to prevent data exfiltration and lateral movement. This is a known, unpatched vulnerability that should be treated as high-risk until mitigated.

Shame score — A long-standing SSRF vulnerability in a widely deployed enterprise application that remains unpatched or unmitigated, exposing internal infrastructure to attackers.

▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.

PLAYERS IMPLICATED

IBM · vendor websphere application server · product

DESCRIPTION

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

AFFECTED FEDRAMP PRODUCTS · 5

PRODUCT	PROVIDER	STATUS	MATCH
IBM Cloud for Government IBM	IBM	Authorized	vendor-exact · 0.90
IBM Federal HR Cloud IBM	IBM	Authorized	vendor-exact · 0.90
IBM Maximo and TRIRIGA on Cloud for U.S. Federal IBM	IBM	Authorized	vendor-exact · 0.90
MaaS360 Enterprise Mobility Management IBM	IBM	Authorized	vendor-exact · 0.90
SmartCloud for Government IBM	IBM	Authorized	vendor-exact · 0.90