CVE-2025-14923 is a medium severity weakness (CVSS 4.7) in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.2. It concerns the Security Utility when it encodes a secret. IBM's fix is the PH69658 interim fix or Liberty fix pack 26.0.0.3 or later. IBM lists no workarounds.
What's affected
IBM's bulletin names IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.2. The issue sits in the Security Utility, the command line tool used to encode passwords and other secrets for Liberty configuration.
The fix is tracked as APAR PH69658. IBM gives two options:
- Upgrade to the minimum fix pack level the interim fix requires, then apply the interim fix.
- Apply Liberty fix pack 26.0.0.3 or later, which IBM described as targeted for the first quarter of 2026.
The bulletin lists no workarounds and no mitigations.
How to check if you're exposed
Check the installed version from the Liberty directory:
bin/productInfo version
Anything from 17.0.0.3 through 26.0.0.2 is in range. Then ask a second question: did anyone use the Security Utility to encode secrets for this server? Look for encoded values in configuration, which Liberty marks with a {xor} or {aes} style prefix in files such as server.xml and bootstrap.properties.
Those encoded strings are the data at risk, so list every file and every system that holds one, including backups and source control.
What to do now
- Find every Liberty install and note whether it is at 26.0.0.2 or earlier.
- Apply the PH69658 interim fix or move to fix pack 26.0.0.3 or later, following IBM's bulletin 7261761.
- List the secrets that were encoded with the Security Utility before the fix. The bulletin does not say whether they must be re-encoded, so read the interim fix notes, and plan to replace high value ones.
- Remove encoded secrets from places that do not need them, such as shared repositories and tickets.
- Keep the encoded values out of logs and chat from now on.
Why it matters
IBM classifies this as CWE-321, Use of Hard-coded Cryptographic Key, and the record also carries CWE-798, Use of Hard-coded Credentials. The common thread is that protection built on a key every installation shares is only obfuscation. Anyone who knows the key can reverse the encoding.
The score is low to medium because exploitation is local, needs a low privilege account and has high attack complexity (AV:L, AC:H, PR:L). The impact is confidentiality only. The record does not mark this CVE as known exploited in CISA's catalog, and the bulletin does not claim active exploitation.
Quick check
What does the Security Utility do in Liberty?
It encodes passwords and other secrets so they are not stored as plain text in configuration files. This CVE is about that encoding giving weaker protection than expected.
Does installing the fix change secrets already encoded?
The bulletin does not say. Read the interim fix notes, and assume secrets encoded before the fix deserve replacement if they protect anything valuable.
Sources
Last reviewed: 19 October 2026.
