CVE-2026-14976 is a remote code execution flaw in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 when the collectiveController-1.0 feature is enabled. It is rated 7.1 (high). IBM's remedy is the interim fix for APAR DT496531 or Liberty fix pack 26.0.0.9 or later.
What's affected
- Product: IBM WebSphere Application Server Liberty, versions 17.0.0.3 through 26.0.0.8.
- Condition: the
collectiveController-1.0feature is enabled. Servers without it are outside the scope IBM describes. - Fix: the interim fix for APAR DT496531, applied after raising the server to the minimum fix pack level the interim fix requires, or Liberty fix pack 26.0.0.9 or later, which IBM lists as targeted for the third quarter of 2026.
- Update history: IBM published the bulletin on 28 July 2026 and added interim fixes for Liberty 26.0.0.8 on 11 August 2026.
- Severity: 7.1 with the record's CWE-306 (missing authentication for critical function). The vector in the record uses adjacent network access and requires user interaction, and marks attack complexity as high. Not on the CISA Known Exploited Vulnerabilities list. IBM lists no workaround.
How to check if you're exposed
Find out whether the collective controller feature is in use. Search the Liberty server configuration:
grep -rn "collectiveController" <liberty_install>/usr/servers/*/ <liberty_install>/usr/shared/config/ 2>/dev/null
IBM's bulletin links its procedure titled "How to determine if Liberty is using a specific feature" and recommends it for this check. A Liberty collective is a group of servers managed together, so the controller is a deliberate choice. If nobody on your team has set up a collective, the feature is probably off, but confirm it in configuration.
Then check the version:
<liberty_install>/bin/productInfo version
A server with the feature enabled and a level in the affected range is in scope. Because the record describes adjacent network access, also note which network segments can reach the controller.
What to do now
- List Liberty servers that use collectiveController-1.0, and their versions.
- Apply the interim fix for DT496531 on those servers, after the minimum fix pack level IBM requires.
- Schedule the move to Liberty 26.0.0.9 or later when it is available to you.
- Limit network access to the controller to the member servers and administrators that need it.
- If you no longer use a collective, remove the feature from the configuration.
- Ask IBM support if you cannot tell which interim fix applies to your fix pack level, and keep the case number with the change record.
Why it matters
The collective controller is the part of a Liberty collective that manages member servers. By design it holds authority over other servers: it can deploy, configure and control them. That is why a missing authentication problem there deserves attention even with a score of 7.1. The record maps the issue to CWE-306, missing authentication for critical function, and IBM describes the result as remote code execution.
The score is moderated by the vector. The record uses adjacent network access, meaning the attacker needs to be on the same network segment or a closely connected one, and it requires user interaction and high attack complexity. That is a narrower window than an internet facing flaw, and it explains the 7.1. It does not make the problem go away: internal attackers, a compromised workstation on the same segment, or a misconfigured network can all satisfy it.
The right way to prioritize is to combine three facts: the feature is on, the version is in range, and the controller can be reached from places you do not fully trust. A server that has all three comes first. A server that has the feature enabled but sits in a tightly controlled management network can wait for the fix pack. A server without the feature needs no emergency action.
As with other IBM bulletins in this series, check the bulletin again later. IBM added interim fixes after the first publication, and the fix pack was still described as a target.
Quick check
What does collectiveController-1.0 do?
It is the Liberty feature that makes a server the controller of a collective, a group of servers managed together. Confirm in your own configuration whether you use it.
Is there a workaround?
IBM's bulletin lists none. Apply the interim fix or fix pack, or remove the feature if you do not need it.
Sources
Last reviewed: 19 October 2026.
