Is CVE-2026-14980 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14980 being exploited in the wild.

How severe is CVE-2026-14980?

High severity, with a CVSS score of 8.3, published 30 July 2026.

Which products and versions are affected?

IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.8.

Is there a fix for CVE-2026-14980?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14980 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14980?

Check whether you run IBM WebSphere Application Server Liberty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14980: IBM WebSphere Application Server Liberty CSRF in collectiveController

CVE-2026-14980 · Severity: high · CVSS 8.3 · Published 2026-07-30

IBM WebSphere Application Server Liberty, a popular framework for building and deploying Java applications, is affected by a security flaw when the collective management feature is enabled. An attacker could trick a legitimate user into performing unintended actions that allow the attacker to make unauthorized requests to internal systems. This could lead to unauthorized access to sensitive data or internal services that are not normally exposed to the internet.

Technologies: IBM WebSphere Application Server Liberty. Vendors: IBM.

Quick answers

Is CVE-2026-14980 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14980 being exploited in the wild.
How severe is CVE-2026-14980?: High severity, with a CVSS score of 8.3, published 30 July 2026.
Which products and versions are affected?: IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.8.
Is there a fix for CVE-2026-14980?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14980 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14980?: Check whether you run IBM WebSphere Application Server Liberty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

IBM WebSphere Application Server Liberty is vulnerable to a Cross-Site Request Forgery (CSRF) attack specifically when the 'collectiveController-1.0' feature is enabled. The vulnerability stems from improper privilege management (CWE-269) during request handling. A remote attacker can exploit this by tricking an authenticated user into visiting a malicious website, which then triggers unauthorized requests. Successful exploitation allows the attacker to perform Server-Side Request Forgery (SSRF) attacks with elevated privileges. IBM has released interim fix PH71678 and recommends upgrading to Liberty Fix Pack 26.0.0.9 or later to remediate the issue.

Affected products

IBM WebSphere Application Server - Liberty 17.0.0.3 - 26.0.0.8

Timeline

2026-07-28: disclosed: Initial publication by IBM
2026-07-30: advisory: NVD publication date

References

https://www.ibm.com/support/pages/node/7281651

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.