CVE-2026-14512 / CVE-2026-14528: IBM WebSphere Unsafe Deserialization and Sensitive Information Exposure (APAR PH72166)

IBM published a critical WebSphere Application Server and Cloud Pak for Applications bulletin on 4 August 2026 for CVE-2026-14512 and CVE-2026-14528 (APAR PH72166). WAS 9.0/8.5 and Cloud Pak 5.1/5.2/5.3 have no official workaround; apply the fix immediately.

IBM published a security bulletin on 4 August 2026 for WebSphere Application Server and bundled IBM Cloud Pak for Applications, disclosing two critical vulnerabilities CVE-2026-14512 and CVE-2026-14528, APAR `PH72166`, classed as unsafe deserialization and sensitive information exposure. Affected versions: WebSphere 9.0.0.0~9.0.5.28, 8.5.5.0~8.5.5.29, and Cloud Pak for Applications 5.1/5.2/5.3. IBM provides no workaround. Apply the fix pack immediately.

Incident overview

WebSphere Application Server is a legacy application server widely used in finance, telecom, and government core systems. IBM Cloud Pak for Applications sits on WAS as an enterprise application platform. Both CVEs share a deserialization defect on the same code path. Deserialization is a classic high-severity Java class: an attacker supplies a crafted serialized stream to trigger a gadget chain, executing arbitrary code in the application context or reading credentials, keys, and connection-pool config from heap/cache.

Technical details

The deserialization path does not restrict instantiable classes when handling crafted objects. Via a gadget chain an attacker can:

• Execute arbitrary code in the application context or invoke restricted management APIs (depends on deployment)

• Read connection-pool credentials, encryption keys, admin passwords, and other sensitive data

Preconditions vary by deployment:

• Network access only: when IIOP, Tivoli Performance Viewer, Admin Console, or SOAP/JMX endpoints are exposed on an untrusted network (no reverse-proxy isolation) and the legacy RMI/IIOP deserialization path is enabled, an unauthenticated remote attacker can exploit directly

• Low-privilege auth: when the console sits behind SSO/CAS, an attacker needs only a normal application account to trigger the chain from a trusted internal network

IBM bulletin states "Workarounds and Mitigations: None". The only official path is the fix pack or a minimized deployment.

Impact assessment

WebSphere's role in financial transactions, telecom billing, and government core systems means a single deserialization bug often cascades upstream and downstream. Cloud Pak for Applications widens the blast radius; 5.1/5.2/5.3 are all in scope. Public gadget toolchains (ysoserial, marshalsec, and IBM-specific chains) are mature; remote exploit barrier is low; weaponization window is short. IBM has not reported in-the-wild use, but PoC engineering maturity alone warrants treating this as urgent for operators and integrators.

Remediation

• Patch: upgrade to the latest WebSphere Fix Pack that includes APAR `PH72166`, or install the interim fix on 9.0.0.0~9.0.5.28 and 8.5.5.0~8.5.5.29. Upgrade Cloud Pak for Applications to the matching patched release.

• Shrink attack surface: during the upgrade window, put Admin Console, IIOP, Tivoli Performance Viewer, SOAP, and JMX ports behind a trusted network/VPN. If exposure is required, reverse-proxy with IP allowlists and rate limits.

• Disable legacy deserialization protocols: in `server.xml` or the admin console, evaluate whether RMI/IIOP and other leftover channels are still required; if not, disable and switch to REST/JWT.

• JEP 290 / Serialization Filter: set `jdk.serialFilter` at the JDK layer to restrict deserialization class loading to WebSphere known-allowlist classes as defense-in-depth before the patch.

• Credential rotation: after upgrade, assume connection-pool, database, LDAP, and keystore credentials on WAS nodes may have leaked; rotate immediately. Audit unusual access to `${was_root}/configmap`, `bootstrap.properties`, and JVM heap dumps.

• Detection and logs: enable WebSphere verbose FFDC and SystemOut logs; watch `SystemErr.log` for `ClassNotFoundException`, `java.io.InvalidClassException`, and similar. IDS rules should flag suspicious POST and Base64 streams on `/soap`, `/iiop`, `/admin`.

References

• IBM Security Bulletin (PH72166)

• NVD CVE-2026-14512

• NVD CVE-2026-14528

• JEP 290: Serialization Filter