CVE-2026-14980: 
IBM WebSphere Application Server vulnerability analysis and mitigation

CVE-2026-14980 is a cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server - Liberty that enables attackers to perform Server-Side Request Forgery (SSRF) attacks with elevated privileges. It affects versions 17.0.0.3 through 26.0.0.8 when the collectiveController-1.0 feature is enabled, and is fixed in version 26.0.0.9. The vulnerability was published on July 30, 2026, with a CVSS v3.1 base score of 8.8 (High) per NVD, or 8.3 (High) per the GitHub Advisory (GitHub Advisory, IBM Support).

The root cause is classified as CWE-269 (Improper Privilege Management), where the application fails to properly enforce privilege boundaries when processing cross-site requests. When the collectiveController-1.0 feature is enabled, a CSRF attack can be leveraged to trigger SSRF requests that execute with elevated server-side privileges, bypassing normal access controls. Exploitation requires user interaction — an authenticated user must be tricked into visiting a malicious webpage that issues forged requests to the vulnerable Liberty server. No public proof-of-concept code has been identified (GitHub Advisory, IBM Support).

Successful exploitation allows an unauthenticated attacker (via a tricked authenticated user) to perform SSRF attacks with elevated privileges, enabling access to internal resources and backend services that would otherwise be restricted. This can result in high confidentiality and integrity impact — including reading sensitive data from backend systems and potentially modifying or deleting internal resources — with a lower but non-zero availability impact. The attack surface is limited to deployments with the collectiveController-1.0 feature enabled (GitHub Advisory, IBM Support).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept as of the time of publication. The EPSS score is approximately 0.22–0.24%, placing it in the 15th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" at this time (GitHub Advisory, IBM Support).

1. Reconnaissance: Identify IBM WebSphere Application Server Liberty instances (versions 17.0.0.3–26.0.0.8) with the collectiveController-1.0 feature enabled, using network scanning or banner grabbing tools.
2. Craft malicious page: Create a webpage containing a forged HTTP request (e.g., a hidden form or JavaScript fetch) targeting the Liberty collective controller endpoint, designed to trigger an SSRF request to an internal resource.
3. Social engineering: Deliver the malicious page link to an authenticated Liberty user via phishing email, chat message, or other means to induce them to visit it while logged into the application.
4. CSRF triggers SSRF: When the victim loads the page, the forged request is sent to the Liberty server with the victim's session credentials; the server processes it with elevated privileges due to the improper privilege management flaw.
5. Access internal resources: The SSRF request reaches internal backend systems or services not directly accessible from the internet, potentially exposing sensitive data or allowing modification of restricted resources (GitHub Advisory, IBM Support).

• Network: Unexpected outbound HTTP/HTTPS requests from the Liberty server to internal IP ranges or non-standard internal endpoints, particularly originating from the collective controller service.
• Logs: Liberty server access logs showing requests to collective controller endpoints (/ibm/api/collective/) originating from unexpected referrer URLs or external origins; CSRF-related errors or unusual cross-origin request patterns in server logs.
• Process/Application: Elevated-privilege operations in Liberty audit logs that do not correspond to known administrative activity; requests to internal services that are not part of normal application workflows.

IBM has released a fix in WebSphere Application Server Liberty version 26.0.0.9; organizations should upgrade immediately. If immediate patching is not feasible, disabling the collectiveController-1.0 feature (if not operationally required) eliminates the attack surface. Additional mitigations include implementing network segmentation to limit SSRF reach, deploying a Web Application Firewall (WAF) to detect and block suspicious cross-origin requests, and enforcing strict CSRF token validation. IBM Cloud Pak for Applications users should also refer to the related IBM security bulletin (IBM Support, IBM Cloud Pak Bulletin).

The vulnerability received standard coverage from vulnerability tracking services (VulnDB, CVEFeed, Vulners) shortly after disclosure. A Bluesky post from CyberHub was noted in early August 2026. No significant researcher commentary, vendor disputes, or major media coverage has been identified beyond routine security bulletin distribution (IBM Support).