External risk intelligence

IBM WebSphere Liberty Authentication Bypass via RTComm Features

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-14525

IBM WebSphere Application Server is commonly deployed as a public-facing web application server or gateway. When the affected rtcomm or rtcommGateway features are enabled, the service is intended to facilitate communication services that are frequently exposed to network traffic, making internet-facing deployment a common and intended usage pattern.

Missing Authentication

Ibm Websphere Application Server

17.0.0.3 to before 26.0.0.9

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects IBM WebSphere Application Server Liberty when specific communication features are enabled, potentially allowing unauthorized access. While the full impact requires understanding specific configurations, it presents a risk to systems handling sensitive communications. The primary concern is to confirm if the affected features are in use within our environment.

Unauthorized access possible with specific features.
Critical vulnerability in common web application servers.
Confirm if vulnerable features are deployed.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication on IBM WebSphere Application Server Liberty by targeting the rtcomm-1.0 or rtcommGateway-1.0 features when they are enabled. This bypass allows an unauthenticated user to potentially gain unauthorized access, leading to serious consequences for data confidentiality and integrity, and possible system disruption.

No authentication required.
rtcomm or rtcommGateway feature enabled.
Unauthorized access, data compromise, system disruption.

Live Threat

Current exploitation, exposure, and threat context

When the rtcomm-1.0 or rtcommGateway-1.0 features are enabled in IBM WebSphere Application Server Liberty, an authentication bypass vulnerability could allow an unauthenticated attacker to access restricted resources or perform unauthorized actions. This could potentially impact the confidentiality, integrity, and availability of the application services, depending on the specific configuration and the functionality of the enabled rtcomm features.

Application authentication and access controls.
Unauthorized network access to features.
Compromised service integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

IBM WebSphere Application Server Liberty deployments with the rtcomm-1.0 or rtcommGateway-1.0 features enabled require immediate attention from platform or application teams responsible for these services. The initial step is to determine the scope of affected systems, assess their exposure and criticality, identify the system owners, and then prioritize remediation efforts.

Platform or application owners should lead.
Verify rtcomm feature enablement and reachability.
Plan coordinated remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM WebSphere Application Server Liberty?

It is a lightweight, modular application server used to build, deploy, and run Java-based web applications and microservices. It is designed for high performance and rapid development, allowing developers to include only the specific features they need for their services, such as the real-time communication capabilities targeted by this vulnerability.

What does CWE-306 mean for CVE-2026-14525?

CWE-306 refers to Missing Authentication for Critical Function. In the context of this CVE, it means the software fails to verify the identity of a user before granting access to sensitive communication features. Because the check is skipped, an attacker can interact with the server as if they were an authorized user.

How does an attacker trigger this authentication bypass?

An attacker triggers this vulnerability by sending network requests to the server when either the rtcomm-1.0 or rtcommGateway-1.0 features are active. If these specific features are not enabled in your server configuration, the bypass vulnerability cannot be triggered, regardless of other settings.

Is my system at risk if it is not exposed to the internet?

Halo Surface Signal indicates that these RTComm features are often used for public-facing communication services. While internet-facing instances are at the highest risk for remote exploitation, any system with these features enabled is vulnerable. You should prioritize internal systems that handle sensitive data or have broad network access.

How do I start securing my environment against this threat?

Your first step is to audit your server configurations to determine if the rtcomm-1.0 or rtcommGateway-1.0 features are currently enabled. If you find these features in use, coordinate with your application teams to evaluate whether the functionality is required or if it can be disabled to mitigate the risk immediately.

References

www.ibm.com/support/pages/node/7283488

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.