INCIBE and NCSC-NL published same-day IBM advisories on 21 August 2026 covering WebSphere middleware, AIX, and PowerVM VIOS fixes. The WebSphere notice names one critical flaw, CVE-2026-14525, plus three high-severity denial-of-service bugs; the AIX and VIOS notice folds in additional IBM platform corrections.
The critical issue is in WebSphere Application Server Liberty when rtcomm-1.0 or rtcommGateway-1.0 is enabled: a request can be treated as authenticated when it should not be. The Apache CXF bugs are different; they let an attacker send oversized form parameters, attachments, or multipart headers so the server burns resources handling them, which means one flaw changes login trust while the others mainly disrupt service.
For shops running Liberty-based apps, the exposure sits at the authentication boundary, not just the patch level, so a server that looks updated can still be wrong about who is logged in if the affected feature is in use. On the AIX and VIOS side, the advisory package is broader but mostly operationally disruptive rather than a code-execution story, so incident scope depends on which IBM stack is actually deployed.