Vulnerabilities · 53 days ago

IBM WebSphere Advisory Mixes Login Bypass and DoS

INCIBE and NCSC-NL published same-day IBM advisories on 21 August 2026 covering WebSphere middleware, AIX, and PowerVM VIOS fixes. The WebSphere notice names one critical flaw, CVE-2026-14525, plus three high-severity denial-of-service bugs; the AIX and VIOS notice folds in additional IBM platform corrections.

The critical issue is in WebSphere Application Server Liberty when rtcomm-1.0 or rtcommGateway-1.0 is enabled: a request can be treated as authenticated when it should not be. The Apache CXF bugs are different; they let an attacker send oversized form parameters, attachments, or multipart headers so the server burns resources handling them, which means one flaw changes login trust while the others mainly disrupt service.

For shops running Liberty-based apps, the exposure sits at the authentication boundary, not just the patch level, so a server that looks updated can still be wrong about who is logged in if the affected feature is in use. On the AIX and VIOS side, the advisory package is broader but mostly operationally disruptive rather than a code-execution story, so incident scope depends on which IBM stack is actually deployed.

CVE-2026-14525

NVD KEV

CVSS 9.4 CRITICAL: iBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is…

CVE-2026-57819

NVD KEV

Timeline

Aug 21 Reported by NCSC-NL Advisories

Sources

2 sources covering this story

NCSC-NL Advisories Aug 21
Meerdere kwetsbaarheden verholpen in IBM AIX en IBM PowerVM VIOS
IBM heeft kwetsbaarheden verholpen in AIX en PowerVM VIOS.
INCIBE-CERT Aug 21
Múltiples vulnerabilidades en IBM WebSphere Application Server
IBM ha publicado 4 vulnerabilidades: 1 de severidad crítica y 3 de severidad alta que, en caso de ser

Entities

CVE-2026-14525
CVE-2026-57819

Part of the PlainSec briefing for 2026-08-24

Editions

Vulnerabilities · 53 days agoIBM WebSphere Advisory Mixes Login Bypass and DoSINCIBE and NCSC-NL published same-day IBM advisories on 21 August 2026 covering WebSphere middleware, AIX, and PowerVM VIOS fixes. The WebSphere notice names one critical flaw, CVE-2026-14525, plus three high-severity denial-of-service bugs; the AIX and VIOS notice folds in additional IBM platform corrections.The critical issue is in WebSphere Application Server Liberty when rtcomm-1.0 or rtcommGateway-1.0 is enabled: a request can be treated as authenticated when it should not be. The Apache CXF bugs are different; they let an attacker send oversized form parameters, attachments, or multipart headers so the server burns resources handling them, which means one flaw changes login trust while the others mainly disrupt service.For shops running Liberty-based apps, the exposure sits at the authentication boundary, not just the patch level, so a server that looks updated can still be wrong about who is logged in if the affected feature is in use. On the AIX and VIOS side, the advisory package is broader but mostly operationally disruptive rather than a code-execution story, so incident scope depends on which IBM stack is actually deployed.