CVE-2026-14529: IBM WebSphere Application Server SSRF

CVE-2026-14529 Overview

CVE-2026-14529 is a Server-Side Request Forgery (SSRF) vulnerability affecting IBM WebSphere Application Server. The flaw exists when the SIP container feature (sipServlet-1.1) is enabled, allowing unauthenticated attackers to coerce the server into issuing arbitrary outbound requests. The vulnerability is classified under [CWE-306] (Missing Authentication for Critical Function) and requires no privileges or user interaction. Affected products include IBM WebSphere Application Server 9.0 and 8.5 traditional editions, plus IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8.

Critical Impact
Unauthenticated attackers can abuse the SIP container to perform SSRF attacks against internal network resources, exposing sensitive data and enabling lateral movement within trusted network segments.

Affected Products

IBM WebSphere Application Server 9.0 (traditional)
IBM WebSphere Application Server 8.5 (traditional)
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.8

Discovery Timeline

2026-07-29 - CVE-2026-14529 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14529

Vulnerability Analysis

CVE-2026-14529 is a Server-Side Request Forgery vulnerability triggered when the Session Initiation Protocol (SIP) container feature is enabled in IBM WebSphere Application Server. The SIP container, activated through the sipServlet-1.1 feature, processes inbound SIP messages without enforcing authentication controls required for critical routing functions. Attackers can craft SIP requests that instruct the server to initiate outbound connections to arbitrary destinations.

The SSRF condition enables adversaries to reach internal-only services, cloud metadata endpoints, or other systems reachable from the WebSphere host. Attackers can enumerate internal network topology, exfiltrate data from restricted resources, and pivot into segments normally isolated from external networks. Impact spans confidentiality, integrity, and limited availability of downstream systems.

Root Cause

The root cause is missing authentication for a critical function [CWE-306] within the SIP servlet container. The sipServlet-1.1 feature accepts and processes network-attacker-controlled input governing request destinations without validating either the requester's identity or the target URL. No allow-list or egress restriction constrains where the server can be induced to send requests.

Attack Vector

The attack vector is network-based and does not require credentials or user interaction. An attacker sends a specially crafted SIP message to a WebSphere instance with sipServlet-1.1 enabled. The container parses attacker-supplied routing data and issues outbound HTTP or SIP requests to targets the attacker specifies. See the IBM Support Page for vendor technical details.

No verified public exploit code is available at this time. Refer to the vendor advisory for authoritative technical details on the vulnerable code paths.

Detection Methods for CVE-2026-14529

Indicators of Compromise

Unexpected outbound HTTP or SIP connections originating from WebSphere Application Server hosts, particularly to internal RFC1918 ranges or cloud metadata endpoints such as 169.254.169.254.
Anomalous SIP INVITE, REGISTER, or OPTIONS messages arriving from untrusted sources targeting ports bound by the SIP container.
WebSphere access and SystemOut logs showing SIP servlet activity correlated with outbound connections to unexpected hosts.

Detection Strategies

Monitor egress traffic from WebSphere hosts for connections to internal management interfaces, metadata services, or hosts outside documented application dependencies.
Inspect SIP traffic for malformed or externally sourced requests reaching servers where the sipServlet-1.1 feature is enabled.
Correlate WebSphere application logs with network flow data to identify SIP-triggered outbound requests.

Monitoring Recommendations

Enable verbose logging on the SIP container and forward logs to a centralized SIEM for correlation with network telemetry.
Baseline normal outbound connections from WebSphere hosts and alert on deviations, especially requests to link-local or private ranges.
Track process and network telemetry from Java processes hosting WebSphere to identify unauthorized destinations.

How to Mitigate CVE-2026-14529

Immediate Actions Required

Apply the IBM security update referenced in the IBM Support Page to all affected WebSphere Application Server 9.0, 8.5, and Liberty 17.0.0.3 through 26.0.0.8 deployments.
Inventory WebSphere instances and identify those with the sipServlet-1.1 feature enabled; prioritize these for immediate remediation.
Restrict egress network access from WebSphere hosts using host-based firewalls or network ACLs to limit SSRF blast radius.

Patch Information

IBM has published remediation guidance and interim fixes in the vendor advisory at the IBM Support Page. Administrators should review the advisory to identify the appropriate fix pack or interim fix for their WebSphere version and deployment topology.

Workarounds

Disable the sipServlet-1.1 feature in Liberty server.xml configurations where SIP functionality is not required.
Block inbound SIP traffic at the network perimeter for WebSphere hosts that do not require external SIP connectivity.
Enforce strict egress filtering to prevent WebSphere hosts from reaching internal management endpoints and cloud metadata services.

bash

# Example: remove sipServlet-1.1 feature from Liberty server.xml
# Edit ${WLP_USER_DIR}/servers/<serverName>/server.xml and remove the feature entry
# <featureManager>
#     <feature>sipServlet-1.1</feature>   <-- remove this line
# </featureManager>
# Then restart the Liberty server:
${WLP_INSTALL_DIR}/bin/server stop <serverName>
${WLP_INSTALL_DIR}/bin/server start <serverName>