CVE-2026-14974 is an unsafe deserialization flaw in IBM WebSphere Application Server traditional versions 8.5 and 9.0, scored 8.1 (high). IBM says a remote attacker could execute arbitrary code. IBM's remedy is the interim fix for APAR DT496118, or fix pack 9.0.5.29 or 8.5.5.31 once available.
What's affected
- Product: IBM WebSphere Application Server traditional, versions 8.5 and 9.0.
- Fix: the interim fix for APAR DT496118, applied after raising the server to the minimum fix pack level the interim fix requires.
- Fix packs: 9.0.5.29 or later for V9.0.0.0 through 9.0.5.28, and 8.5.5.31 or later for V8.5.0.0 through 8.5.5.30. IBM lists both as targeted for the third quarter of 2026.
- Same bulletin: it also covers CVE-2026-14515, a cross site scripting flaw scored 6.1.
- Severity: 8.1 with the record's CWE-502 (deserialization of untrusted data). Not on the CISA Known Exploited Vulnerabilities list. IBM lists no workaround.
How to check if you're exposed
Get the exact level of each traditional WebSphere installation:
<was_root>/bin/versionInfo.sh
The output lists the installed product version and any applied interim fixes. Compare it with the ranges above and look for DT496118 among the interim fixes. Run it on every node in a cell, since nodes can drift.
Then consider reach. List which servers are reachable from outside your trusted network and which applications run on them. An application server that sits behind a gateway and is not directly exposed is lower urgency than one on a shared or public network. Do the same for administrative consoles and management ports.
Because the record scores network access, no privileges and no user interaction but marks attack complexity as high, exploitation is not expected to be trivial. That is a prioritization input, not a reason to skip the fix.
What to do now
- Find every traditional WebSphere server on 8.5 or 9.0, and list the fix pack level of each.
- Apply the interim fix for DT496118, after bringing each server to the minimum fix pack level the interim fix requires.
- Plan the move to 9.0.5.29 or 8.5.5.31 when the fix packs are available.
- Limit network exposure of the application server and its administrative ports to what is needed.
- Review applications that accept serialized Java objects from outside and replace them with formats that carry only data where you can.
- Ask IBM support if you cannot tell which interim fix applies to your fix pack level, and keep the case number with the change record.
Why it matters
Deserialization turns bytes back into live objects. In Java, the default mechanism can create objects of many classes, run code in their constructors and related methods, and link them together before the application has checked anything. If those bytes come from an attacker, the attacker chooses which objects get built. CWE-502 is the weakness class for exactly this: deserialization of untrusted data.
IBM's description is brief. It says unsafe deserialization of untrusted data could allow remote code execution on WebSphere traditional 8.5 and 9.0. The record's vector adds that the attack complexity is high, which usually means the attacker needs conditions to line up, such as a particular reachable endpoint or a usable class on the server. IBM does not publish the endpoint, and neither should an internal ticket guess at it.
That leaves the practical work. First, patch on a schedule that reflects exposure, using the interim fix now where the server is reachable and the fix pack at the next window elsewhere. Second, reduce what deserialization can do. Many Java platforms support allowlists of classes that may be deserialized, and the single best long term step is to stop accepting serialized objects from untrusted sources at all.
Third, take advantage of the bulletin to clear the paired XSS fix in the same change. Combining them saves a second maintenance window and keeps the version record simple.
Quick check
Does this affect Liberty?
The bulletin and the record name WebSphere Application Server traditional 8.5 and 9.0. Liberty is not listed for this CVE.
Is the cross site scripting flaw fixed by the same update?
The bulletin covers both CVE-2026-14974 and CVE-2026-14515 under the same APAR and fix packs.
Sources
Last reviewed: 19 October 2026.
