CVE-2026-14512 / CVE-2026-14528: IBM WebSphere Unsafe Deserialization and Sensitive Information Exposure (APAR PH72166)

IBM published a critical security bulletin on 4 August 2026 for WebSphere Application Server and Cloud Pak for Applications: CVE-2026-14512 and CVE-2026-14528 cover unsafe deserialization and sensitive information exposure (APAR PH72166). Affected versions include WAS 9.0/8.5 and Cloud Pak 5.1/5.2/5.3. IBM provides no workaround; apply patches immediately.

IBM published a security bulletin on 4 August 2026 for WebSphere Application Server and bundled IBM Cloud Pak for Applications, disclosing two critical vulnerabilities, CVE-2026-14512 and CVE-2026-14528, tracked as APAR `PH72166`. Categories: unsafe deserialization and sensitive information exposure. Affected versions cover WebSphere 9.0.0.0~9.0.5.28, 8.5.5.0~8.5.5.29, and Cloud Pak for Applications 5.1/5.2/5.3. IBM provides no workaround and strongly recommends applying the fix pack immediately.

Event Overview

WebSphere Application Server is a traditional application server widely used in finance, telecom, and government core systems. IBM Cloud Pak for Applications is built on WAS and provides an enterprise application platform. Both CVEs originate from a deserialization handling defect on the same code path. Deserialization vulnerabilities are among the most classic high-risk classes in the Java ecosystem—attackers use crafted serialized streams to trigger a gadget chain, executing arbitrary code in the application context or reading credentials, keys, and connection-pool configuration from heap/cache.

Technical Details

The deserialization path does not restrict which classes can be instantiated when processing crafted objects. Via a gadget chain an attacker can:

• Execute arbitrary code in the application context or invoke restricted management APIs (depends on deployment)

• Read sensitive data such as connection-pool credentials, encryption keys, and administrator passwords

Attack prerequisites vary by deployment:

• Network access only: when IIOP, Tivoli Performance Viewer, Admin Console, or SOAP/JMX endpoints are exposed on untrusted networks (no reverse-proxy isolation) and the legacy RMI/IIOP deserialization path is enabled, an unauthenticated remote attacker can exploit directly

• Low-privilege authentication: when the console sits behind SSO/CAS, an attacker needs only a regular application account to trigger the chain from a trusted internal network

IBM's bulletin states "Workarounds and Mitigations: None". The only official mitigation path is installing the fix or reverting to a minimized deployment.

Impact Assessment

WebSphere's role in financial transactions, telecom billing, and government core systems means a single deserialization bug often cascades upstream and downstream. Cloud Pak for Applications expands the blast radius further—versions 5.1/5.2/5.3 are all in scope. Public gadget toolchains (ysoserial, marshalsec, and IBM-specific chains) are mature; remote exploitation barrier is low; the window to weaponization is short. IBM has not reported in-the-wild exploitation, but given PoC engineering maturity, operators/integrators should treat this as urgent.

Remediation

• Apply patches: upgrade to the latest WebSphere Fix Pack that includes APAR `PH72166`, or install the interim fix on 9.0.0.0~9.0.5.28 and 8.5.5.0~8.5.5.29. Upgrade Cloud Pak for Applications to the corresponding patched release.

• Reduce attack surface: during the upgrade window, place Admin Console, IIOP, Tivoli Performance Viewer, SOAP, and JMX ports behind a trusted network/VPN. If exposure is required, use a reverse proxy with IP allowlisting and rate limiting.

• Disable legacy deserialization protocols: in `server.xml` or the admin console, evaluate whether RMI/IIOP and similar legacy channels are still required; disable them if not and switch to REST/JWT.

• JEP 290 / Serialization Filter: configure `jdk.serialFilter` at the JDK layer to restrict deserialization class loading to WebSphere-known allowlisted classes, as defense in depth before the patch.

• Credential rotation: after upgrade, assume connection-pool, database, LDAP, and keystore credentials that may have been exposed on WAS nodes should be rotated immediately. Audit unusual access to `${was_root}/configmap`, `bootstrap.properties`, and JVM heap dumps.

• Detection and logs: enable detailed WebSphere FFDC and SystemOut logs; monitor `SystemErr.log` for `ClassNotFoundException`, `java.io.InvalidClassException`, and similar exceptions. IDS rules should watch `/soap`, `/iiop`, `/admin` for suspicious POSTs and Base64 streams.

References

• IBM Security Bulletin (PH72166)

• NVD CVE-2026-14512

• NVD CVE-2026-14528

• JEP 290: Serialization Filter