CVE-2025-14915 PUBLISHED

IBM WebSphere Application Server Liberty is affected by a privilege escalation vulnerability

Assigner: ibm
Reserved: 18.12.2025 Published: 25.03.2026 Updated: 26.03.2026

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged user could gain additional access to the application server.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 6.5

Product Status

Vendor IBM
Product WebSphere Application Server - Liberty
Versions
  • affected from 17.0.0.3 to 26.0.0.3 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH70327. To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to  How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 . 

For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.3 using the restConnector-1.0 or restConnector-2.0 feature(s):  · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves  PH70327 https://www.ibm.com/support/pages/node/7266844   --OR-- · Apply Liberty Fix Pack 26.0.0.4 or later (targeted availability 2Q2026). 

Additional interim fixes may be available and linked off the interim fix download page.

References

Problem Types

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE