CVE-2025-14917 is a medium severity flaw (CVSS 6.7) in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.3. It affects servers with an appSecurity feature enabled and rests on a default password issue. IBM's fix is the PH70078 interim fix, or Liberty fix pack 26.0.0.4 or later, plus manual steps after installing.
What's affected
IBM's bulletin lists IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.3 on Windows, Linux, AIX, IBM i, z/OS and macOS. The exposure applies when one of these features is enabled:
- appSecurity-1.0
- appSecurity-2.0
- appSecurity-3.0
- appSecurity-4.0
- appSecurity-5.0
If none of those features is turned on, the bulletin's remediation text does not apply to your server. Confirm that against the bulletin rather than assuming.
The fix is tracked as APAR PH70078. IBM offers two routes: upgrade to the minimum fix pack level the interim fix requires and then apply the interim fix, or install Liberty fix pack 26.0.0.4 or later (IBM listed it as targeted for the second quarter of 2026). IBM states there are no workarounds or mitigations.
How to check if you're exposed
Start with the version. From the Liberty install directory:
bin/productInfo version
Then look at which features each server loads. In server.xml (and any included config files) the featureManager block lists them. Search for appSecurity:
grep -rn "appSecurity" usr/servers/*/server.xml usr/servers/*/configDropins
Any hit on appSecurity-1.0 through appSecurity-5.0 on a version in the affected range puts the server in scope. IBM links a page titled "How to determine if Liberty is using a specific feature" from the bulletin, which is the authoritative method.
What to do now
- Inventory every Liberty server and record its version and whether an appSecurity feature is enabled.
- Read IBM's bulletin 7267362 and download the PH70078 interim fix, or plan the move to fix pack 26.0.0.4 or later.
- Apply the fix, then carry out the additional instructions that ship with the interim fix. IBM says remediation is not complete without them.
- Review the credentials and security settings the server uses for administration, and rotate any that were set up with defaults.
- Re-check version and feature state after the change and record it in your asset list.
Why it matters
The weakness is classed as CWE-1393, Use of Default Password. IBM describes the effect only as weaker than expected security when administering security settings, so treat the exact mechanics as something to read in the bulletin and the interim fix notes.
The score is moderate because the vector is local and needs high privileges (AV:L, PR:H). That does not make it ignorable. On a shared host, or after any foothold on a Liberty machine, a default credential issue turns a small problem into a larger one. The record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and IBM's bulletin does not describe active exploitation.
Where this fits in a patch cycle
Liberty is often embedded in application images and run by teams that do not own the host. Ask each application owner which Liberty build ships in their image, because a base image rebuild is how the fix usually reaches them. The free in-browser dependency scan at https://gold.safeguard.sh/scan checks a manifest against known vulnerabilities without installing anything. The Gold directory pages for each CVE and CWE collect the same facts in one place.
Quick check
Does IBM offer a workaround for CVE-2025-14917?
No. The bulletin says there are no workarounds or mitigations, so the only route is the interim fix or a fix pack that contains the PH70078 change, plus the post-install steps.
Is a server without appSecurity features affected?
IBM's remediation text applies to servers using the appSecurity-1.0 to appSecurity-5.0 features. Check the bulletin for your exact configuration before ruling a server out.
Sources
Last reviewed: 19 October 2026.
