CVE-2025-14917: 
IBM WebSphere Application Server vulnerability analysis and mitigation

CVE-2025-14917 is a security weakness vulnerability in IBM WebSphere Application Server (WAS) Liberty that causes the server to provide weaker than expected security when administering security settings. It affects IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.3. The vulnerability was published on March 25, 2026. NVD assigns a CVSS v3.1 base score of 9.8 (Critical) with a network-based, unauthenticated attack vector, while ENISA's EUVD assigns a score of 6.7 (Medium) reflecting a local, high-privilege attack vector — indicating some scoring discrepancy across sources (IBM Support, Red Hat CVE).

The vulnerability is rooted in insufficient security enforcement when administering security settings within IBM WebSphere Application Server Liberty, potentially associated with CWE-1393 (Use of Default Password) based on third-party classification (Radar Offseq). The NVD CVSS vector indicates the vulnerability is exploitable remotely over the network without authentication or user interaction, suggesting that security controls governing administrative functions can be bypassed under certain conditions. The ENISA scoring, by contrast, reflects a local, high-privilege scenario, suggesting the precise exploitation preconditions remain ambiguous pending further vendor clarification. No public proof-of-concept or detailed technical write-up has been published as of the time of this report (IBM Support).

Successful exploitation could allow an attacker to bypass security controls in IBM WebSphere Application Server Liberty, potentially resulting in unauthorized access to sensitive configuration data, modification of security settings, and disruption of service availability. The vulnerability carries high confidentiality, integrity, and availability impact ratings under the NVD scoring model. Multiple IBM products that ship with WAS Liberty are also affected, including SPSS Collaboration and Deployment Services, IBM CICS TX Advanced, IBM Voice Gateway, IBM Application Modernization Accelerator, IBM Transformation Advisor, and IBM License Metric Tool (IBM Support, IBM CICS TX). A CSO Online report noted that seven IBM WebSphere Liberty flaws, including this one, can be chained together to achieve full system takeover (CSO Online).

IBM has released a fix in WebSphere Application Server Liberty version 26.0.0.4, and organizations should upgrade all affected instances (versions 17.0.0.3 through 26.0.0.3) to this version or later as the primary remediation (IBM Support, Open Liberty Blog). As interim mitigations, organizations should implement network segmentation to restrict access to administrative interfaces, enforce strong access controls for security administration functions, and monitor administrative activity for anomalies. Downstream IBM products (SPSS Collaboration and Deployment Services, CICS TX Advanced, Voice Gateway, Application Modernization Accelerator, Transformation Advisor, License Metric Tool) have separate security bulletins and should be patched per their respective advisories (IBM CICS TX, IBM Voice Gateway).

CSO Online reported that CVE-2025-14917 is one of seven IBM WebSphere Liberty vulnerabilities that can be chained together to achieve full system takeover, elevating its practical risk beyond what the individual CVSS score might suggest (CSO Online). The Open Liberty project published a blog post accompanying the 26.0.0.4 release that addresses this and related vulnerabilities (Open Liberty Blog). InfoQ covered the vulnerability as part of its Java news roundup for April 2026, reflecting broader developer community awareness (InfoQ).