External risk intelligence

IBM WebSphere Liberty Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-14976

IBM WebSphere Application Server is a commonly deployed enterprise application platform. While the specific collectiveController-1.0 feature may be used for internal clustering, application servers are frequently deployed as internet-facing services or are exposed through gateway and API management configurations, making network-based reachability a common deployment pattern.

Missing Authentication

Ibm Websphere Application Server

17.0.0.3 to before 26.0.0.9

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

IBM WebSphere Application Server - Liberty is affected by a critical vulnerability when the `collectiveController-1.0` feature is enabled, allowing for remote code execution. This matters because IBM WebSphere is a widely used enterprise platform. The main concern is confirming if this specific feature is in use within your environment.

Allows remote control of systems.
Critical issue with widely used software.
Confirm `collectiveController-1.0` feature use.

Attack Path

How an attacker could exploit the issue

An attacker can reach an affected IBM WebSphere Application Server if the `collectiveController-1.0` feature is enabled. This vulnerability can lead to remote code execution.

No authentication or privileges required.
Network access to the vulnerable feature.
Full remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When the `collectiveController-1.0` feature is enabled in IBM WebSphere Application Server - Liberty, a remote attacker could execute arbitrary code. This could impact the confidentiality, integrity, and availability of the affected system.

System access and control.
Network access without authentication.
Compromise of application server.

Operational Fix

Recommended remediation, mitigation, and detection steps

Identifying and addressing this critical vulnerability requires collaboration between application owners, infrastructure teams, and potentially vendor management. The first practical step is to determine the presence of the affected IBM WebSphere Application Server - Liberty versions within your environment, ascertain their exposure, confirm their business criticality, and then locate the accountable system owner. Once ownership is established, a risk-based remediation plan can be developed, potentially involving coordination with IBM or relevant support teams.

Application and infrastructure teams own remediation.
Verify Liberty feature collectiveController-1.0 enablement.
Plan remediation based on confirmed exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM WebSphere Application Server - Liberty?

IBM WebSphere Application Server - Liberty is a flexible, lightweight Java application runtime used by organizations to build, deploy, and manage enterprise applications. It provides the necessary environment to run web applications and services efficiently, often acting as the backbone for critical business logic and data processing in corporate IT infrastructures.

What does CVE-2026-14976 mean for system security?

This vulnerability is classified as CWE-306, which relates to a lack of authentication for a critical function. In the context of CVE-2026-14976, it means the application server fails to properly verify the identity of someone trying to access specific features. This security gap allows an unauthenticated, remote attacker to execute arbitrary code on the underlying system, potentially gaining full control over the application server.

How is this vulnerability triggered in Liberty?

The flaw is triggered specifically when the collectiveController-1.0 feature is enabled in your Liberty configuration. This feature is intended to manage server clusters. If this feature is disabled, the specific code path that leads to this remote code execution vulnerability remains inactive, meaning systems without this feature active are not susceptible to this specific attack vector.

Is my IBM WebSphere server at risk from the internet?

According to Halo Surface Signal, this vulnerability is classified as external because the attack vector is network-based. While the collectiveController-1.0 feature is often used for internal clustering, these servers are frequently deployed as internet-facing services or exposed via gateways. You should prioritize checking any instances that have a path from the network, as they are reachable by external actors.

What steps should I take if I use this software?

First, inventory your systems to identify all instances running the affected Liberty versions (17.0.0.3 through 26.0.0.8). Next, verify if the collectiveController-1.0 feature is enabled in your configuration files. If active, coordinate with your infrastructure and application teams to assess the server's network exposure and business criticality, then work with your vendor support channels to apply the necessary updates or mitigate the risk.

References

www.ibm.com/support/pages/node/7281633

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.