IBM WebSphere Application Server 9.0

CVE-2026-14529 is a missing-authentication flaw (CWE-306) in the SIP (Session Initiation Protocol) container of IBM WebSphere Application Server. When the sipServlet-1.1 feature is enabled, an unauthenticated remote attacker can forge server-side requests through the SIP endpoint (typically port 5060/5061), achieving high-impact reads and writes against internal services. Affected versions span WAS traditional 8.5.x and 9.0.x, plus Liberty 17.0.0.3 through 26.0.0.8. Fixes target WAS 9.0.5.29 and Liberty 26.0.0.9, both slated for Q3 2026.

IBM rated this CRITICAL at 9.4 and the CVSS vector backs it up on paper — network-reachable, no auth, no user interaction, high confidentiality and integrity impact. That score is *technically correct for the subset of installs running SIP*. But the SIP container is a niche telephony feature used in unified communications and VoIP deployments; the overwhelming majority of WebSphere estates never enable sipServlet-1.1. This prerequisite dramatically shrinks the real-world blast radius. Combined with an EPSS of 0.33%, no KEV listing, no public PoC, and no GreyNoise signals, the vendor score overstates risk for most enterprises. noisgate downgrades to HIGH 7.5 — still urgent for SIP-enabled deployments, but not a fleet-wide fire drill.

Why this verdict

• sipServlet-1.1 prerequisite narrows population: The SIP container feature is a specialized telephony/UC capability. The vast majority of WebSphere deployments are traditional Java EE application servers that never enable SIP. This prerequisite alone eliminates ~95% of the installed base from being vulnerable, warranting a meaningful severity reduction.
• No exploitation signals: EPSS at 0.33%, no KEV listing, no GreyNoise tags, no public PoC, and the CVE is only two days old. The predecessor CVE-2025-27907 (same component, auth-required variant) never saw exploitation either. The practical threat is currently theoretical.
• SIP ports rarely internet-facing: Enterprise SIP infrastructure typically sits behind session border controllers (SBCs) on internal voice VLANs. Even when sipServlet-1.1 is enabled, the SIP listener is almost never directly reachable from the internet, adding a network-access friction layer the CVSS score doesn't account for.
• Role multiplier: WebSphere is an application server (typical role: line-of-business tier). The SIP-enabled subset serves telephony workloads — not identity, not backup, not hypervisor. Chain success in a SIP-enabled deployment yields SSRF from the app tier (host-level blast radius, possibly tenant-level if cloud IMDS is reachable). This does not reach domain/fleet/supply-chain scale. The role does not trigger the HIGH→CRITICAL floor override.
• Scope:Unchanged limits blast radius: The CVSS S:U designation means impact is confined to the WebSphere server's own authorization context. The attacker does not break out of the component boundary, though SSRF can indirectly reach other services the host can access.

Why not higher?

The CVSS vector is maximally accessible (AV:N/AC:L/PR:N/UI:N) and the C:H/I:H impact is real when SIP is enabled. However, CRITICAL requires either broad population exposure or a high-value-role multiplier. The sipServlet-1.1 prerequisite eliminates the broad population condition, and WebSphere SIP endpoints are not canonically fleet-scale infrastructure (not DCs, not hypervisors, not identity providers). No active exploitation further undermines urgency.

Why not lower?

Despite the narrow affected population, this is still an unauthenticated SSRF with missing authentication on a critical function — the most dangerous SSRF class. For organizations that DO run SIP on WebSphere, the chain is trivial (no auth, low complexity) and impact is high. The predecessor CVE-2025-27907 was only Medium because it required admin-level auth; removing that gate is a material escalation. MEDIUM would understate the risk for affected deployments.

1. Disable sipServlet-1.1 if not actively used — Most WebSphere deployments do not need SIP functionality. In Liberty, remove sipServlet-1.1 from server.xml features. In WAS traditional, remove SIP container configuration. This eliminates the vulnerability entirely. Verify within 30 days per the noisgate mitigation SLA for HIGH findings.
2. Firewall SIP ports to authorized voice VLANs only — Block inbound traffic to ports 5060/5061 (UDP and TCP) from all sources except known SIP peers (IP-PBX, SBC, UC clients). Apply at both host firewall and network perimeter. This prevents unauthenticated remote exploitation even if the feature remains enabled. Deploy within 30 days.
3. Deploy a session border controller (SBC) in front of SIP endpoints — SBCs validate SIP message structure, enforce topology hiding, and can block malformed or suspicious SIP URIs before they reach WebSphere. If you run production SIP, you should already have an SBC — verify it is inline. Deploy within 30 days.
4. Enable IMDSv2 on cloud-hosted WebSphere instances — If WebSphere runs on AWS EC2, enforcing IMDSv2 (hop limit=1, PUT token required) blocks the most common SSRF-to-credential-theft chain. This limits the blast radius of any SSRF exploitation. Deploy immediately for cloud workloads.

Run on each WebSphere host (traditional or Liberty) as the WebSphere admin user or root. For Liberty: bash check_cve_2026_14529.sh /opt/ibm/wlp. For traditional WAS: bash check_cve_2026_14529.sh /opt/IBM/WebSphere/AppServer. No network access required.

#!/bin/bash
# check_cve_2026_14529.sh — Detect CVE-2026-14529 exposure
# Usage: bash check_cve_2026_14529.sh <WAS_HOME>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail
WAS_HOME="${1:-}"

if [ -z "$WAS_HOME" ]; then
  echo "Usage: $0 <WAS_HOME>"
  echo "UNKNOWN - no WAS_HOME provided"
  exit 2
fi

SIP_ENABLED=false
IS_LIBERTY=false
RESULT="UNKNOWN"

# Detect Liberty vs traditional
if [ -f "$WAS_HOME/bin/server" ] || [ -d "$WAS_HOME/usr/servers" ]; then
  IS_LIBERTY=true
  echo "[*] Detected Liberty installation at $WAS_HOME"
  # Check all server.xml files for sipServlet-1.1
  while IFS= read -r -d '' sxml; do
    if grep -qi 'sipServlet-1.1' "$sxml" 2>/dev/null; then
      SIP_ENABLED=true
      echo "[!] sipServlet-1.1 ENABLED in: $sxml"
    fi
  done < <(find "$WAS_HOME/usr/servers" -name 'server.xml' -print0 2>/dev/null)
  
  # Check Liberty version
  VERSION_FILE="$WAS_HOME/lib/versions/openliberty.properties"
  [ ! -f "$VERSION_FILE" ] && VERSION_FILE="$WAS_HOME/lib/versions/WebSphereApplicationServer.properties"
  if [ -f "$VERSION_FILE" ]; then
    VERSION=$(grep 'product.version' "$VERSION_FILE" 2>/dev/null | head -1 | cut -d'=' -f2 | tr -d ' ')
    echo "[*] Liberty version: $VERSION"
    # Compare: vulnerable if < 26.0.0.9
    if [ -n "$VERSION" ]; then
      MAJOR=$(echo "$VERSION" | cut -d. -f1)
      MINOR=$(echo "$VERSION" | cut -d. -f2)
      PATCH=$(echo "$VERSION" | cut -d. -f3)
      BUILD=$(echo "$VERSION" | cut -d. -f4)
      if [ "$MAJOR" -lt 26 ] || ([ "$MAJOR" -eq 26 ] && [ "$MINOR" -eq 0 ] && [ "$PATCH" -eq 0 ] && [ "$BUILD" -lt 9 ]); then
        if $SIP_ENABLED; then
          RESULT="VULNERABLE"
        else
          RESULT="PATCHED"
          echo "[*] Version is in affected range but sipServlet-1.1 is NOT enabled — not exploitable"
        fi
      else
        RESULT="PATCHED"
      fi
    fi
  else
    echo "[?] Could not determine Liberty version"
  fi
else
  echo "[*] Detected traditional WAS installation at $WAS_HOME"
  # Check for SIP container in traditional WAS
  if [ -x "$WAS_HOME/bin/versionInfo.sh" ]; then
    VERSION=$($WAS_HOME/bin/versionInfo.sh 2>/dev/null | grep 'Version' | head -1 | awk '{print $NF}')
    echo "[*] WAS version: $VERSION"
  fi
  # Check SIP in config
  CONFIGS=$(find "$WAS_HOME/profiles" -name 'server.xml' -o -name 'sip*.xml' 2>/dev/null || true)
  for cfg in $CONFIGS; do
    if grep -qi 'sipcontainer\|sipservlet\|SIPContainer' "$cfg" 2>/dev/null; then
      SIP_ENABLED=true
      echo "[!] SIP container reference found in: $cfg"
    fi
  done
  if [ -n "${VERSION:-}" ]; then
    FP=$(echo "$VERSION" | cut -d. -f4)
    MAJOR=$(echo "$VERSION" | cut -d. -f1)
    MINOR=$(echo "$VERSION" | cut -d. -f2)
    if ([ "$MAJOR" -eq 9 ] && [ "${FP:-0}" -lt 29 ]) || [ "$MAJOR" -eq 8 ]; then
      if $SIP_ENABLED; then
        RESULT="VULNERABLE"
      else
        RESULT="PATCHED"
        echo "[*] Version is in affected range but SIP container is NOT enabled — not exploitable"
      fi
    else
      RESULT="PATCHED"
    fi
  fi
fi

if ! $SIP_ENABLED && [ "$RESULT" != "PATCHED" ]; then
  echo "[*] sipServlet-1.1 / SIP container not detected in configuration"
  RESULT="PATCHED"
fi

echo ""
echo "=== CVE-2026-14529 STATUS: $RESULT ==="
exit $([ "$RESULT" = "PATCHED" ] && echo 0 || ([ "$RESULT" = "VULNERABLE" ] && echo 1 || echo 2))

Sources

1. CVE-2026-14529 — THREATINT
2. IBM Security Bulletin — WebSphere Multiple Vulnerabilities (July 2026)
3. HKCERT — IBM WebSphere Products Multiple Vulnerabilities (2026-07-30)
4. CVE-2025-27907 — Predecessor SIP SSRF (NVD)
5. IBM Documentation — sipServlet-1.1 Feature
6. IBM Documentation — SIP in WebSphere Application Server
7. CWE-306 — Missing Authentication for Critical Function