critical

CVE-2026-14512

WebSphere pre-authentication unsafe deserialization -> auth bypass / RCE

Severity: critical
Affected product: IBM WebSphere Application Server
Affected versions: IBM WebSphere Application Server all versions before the fix
Fixed in: IBM WebSphere Application Server IBM interim fix (8.5 / 9.0)
Detection basis: Appliance fingerprint
Shipped rule: IBM WebSphere Application Server: WebSphere pre-authentication unsafe deserialization -> auth bypass / RCE
EPSS: 1% chance of exploitation in the next 30 days
Added to NewScan: 2026-07-29
Detected by: NewScan — free, self-hosted

How NewScan reports it

APPLIANCE FINGERPRINT

NewScan fingerprints the IBM WebSphere Application Server appliance and reports this CVE when the detected version falls inside the affected range below.

References

NVD — CVE-2026-14512 ↗
CVE Record ↗

Scan for this yourself — local, in-band scanning is free.

Get NewScan (FREE) →

Review the measured benchmark, then use the verified remediation process.