CVE-2025-14917

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14917", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-12-18T19:59:28.180Z", "datePublished": "2026-03-25T20:13:55.049Z", "dateUpdated": "2026-03-27T03:55:36.998Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-25T20:19:13.832Z"}, "title": "IBM WebSphere Application Server Liberty could provide weaker than expected security", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1393", "description": "CWE-1393 Use of Default Password", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "WebSphere Application Server - Liberty", "versions": [{"status": "affected", "version": "17.0.0.3", "lessThanOrEqual": "26.0.0.3", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.3:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7267362", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.7, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR\u00a0PH70078.\u00a0To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to\u00a0 How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 .\u00a0\n\nAttention: After installing the interim fix or fixpack, please follow the additional instructions provided in the interim fix link referenced below to complete the remediation.\n\nFor IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.3 using the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0 or appSecurity-5.0 feature(s):\u00a0\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves\u00a0 PH70078 https://www.ibm.com/support/pages/node/7266845 \u00a0and carefully follow the instructions for steps required after fix installation.\n--OR--\n\u00b7 Apply Liberty Fix Pack 26.0.0.4 or later (targeted availability 2Q2026).\n\nAdditional interim fixes may be available and linked off the interim fix download page.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR&nbsp;PH70078.&nbsp;To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to&nbsp;<a title=\"How to determine if Liberty is using a specific feature\" href=\"https://www.ibm.com/support/pages/node/6553910\" rel=\"nofollow\">How to determine if Liberty is using a specific feature</a>.&nbsp;</p><p><strong>Attention: After installing the interim fix or fixpack, please follow the additional instructions provided in the interim fix link referenced below to complete the remediation.</strong><br><br><strong>For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.3 using the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0 or appSecurity-5.0 feature(s):&nbsp;</strong><br>\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves&nbsp;<a href=\"https://www.ibm.com/support/pages/node/7266845\" rel=\"nofollow\">PH70078</a>&nbsp;<strong>and carefully follow the instructions for steps required after fix installation.</strong><br>--OR--<br>\u00b7 Apply Liberty Fix Pack 26.0.0.4 or later (targeted availability 2Q2026).<br><br>Additional interim fixes may be available and linked off the interim fix download page.</p>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-14917"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T03:55:36.998Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14917", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-26T17:40:11.093441Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T17:49:44.744Z"}}], "cna": {"title": "IBM WebSphere Application Server Liberty could provide weaker than expected security", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.3:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "WebSphere Application Server - Liberty", "versions": [{"status": "affected", "version": "17.0.0.3", "versionType": "semver", "lessThanOrEqual": "26.0.0.3"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR\u00a0PH70078.\u00a0To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to\u00a0 How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 .\u00a0\n\nAttention: After installing the interim fix or fixpack, please follow the additional instructions provided in the interim fix link referenced below to complete the remediation.\n\nFor IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.3 using the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0 or appSecurity-5.0 feature(s):\u00a0\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves\u00a0 PH70078 https://www.ibm.com/support/pages/node/7266845 \u00a0and carefully follow the instructions for steps required after fix installation.\n--OR--\n\u00b7 Apply Liberty Fix Pack 26.0.0.4 or later (targeted availability 2Q2026).\n\nAdditional interim fixes may be available and linked off the interim fix download page.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR&nbsp;PH70078.&nbsp;To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to&nbsp;<a title=\"How to determine if Liberty is using a specific feature\" href=\"https://www.ibm.com/support/pages/node/6553910\" rel=\"nofollow\">How to determine if Liberty is using a specific feature</a>.&nbsp;</p><p><strong>Attention: After installing the interim fix or fixpack, please follow the additional instructions provided in the interim fix link referenced below to complete the remediation.</strong><br><br><strong>For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.3 using the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0 or appSecurity-5.0 feature(s):&nbsp;</strong><br>\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves&nbsp;<a href=\"https://www.ibm.com/support/pages/node/7266845\" rel=\"nofollow\">PH70078</a>&nbsp;<strong>and carefully follow the instructions for steps required after fix installation.</strong><br>--OR--<br>\u00b7 Apply Liberty Fix Pack 26.0.0.4 or later (targeted availability 2Q2026).<br><br>Additional interim fixes may be available and linked off the interim fix download page.</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7267362", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1393", "description": "CWE-1393 Use of Default Password"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-25T20:19:13.832Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14917", "state": "PUBLISHED", "dateUpdated": "2026-03-27T03:55:36.998Z", "dateReserved": "2025-12-18T19:59:28.180Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-03-25T20:13:55.049Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.3:*:*:*:*:*:*:*"], "product": "WebSphere Application Server - Liberty", "vendor": "IBM", "versions": [{"lessThanOrEqual": "26.0.0.3", "status": "affected", "version": "17.0.0.3", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:*", "matchCriteriaId": "815C3061-AAD1-4A76-9E8C-BAE5F894C6E3", "versionEndExcluding": "26.0.0.4", "versionStartIncluding": "17.0.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*", "matchCriteriaId": "E492C463-D76E-49B7-A4D4-3B499E422D89", "vulnerable": false}, {"criteria": "cpe:2.3:o:ibm:i:-:*:*:*:*:*:*:*", "matchCriteriaId": "C684FC45-C9BA-4EF0-BD06-BB289450DD21", "vulnerable": false}, {"criteria": "cpe:2.3:o:ibm:z\\/os:-:*:*:*:*:*:*:*", "matchCriteriaId": "0E97A964-6F9E-4C87-9B90-21AE2C1DF52F", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings."}, {"lang": "es", "value": "IBM WebSphere Servidor de Aplicaciones - Liberty 17.0.0.3 hasta 26.0.0.3 IBM WebSphere Servidor de Aplicaciones Liberty podr\u00eda proporcionar seguridad m\u00e1s d\u00e9bil de lo esperado al administrar las configuraciones de seguridad."}], "id": "CVE-2025-14917", "lastModified": "2026-06-17T08:36:46.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14917", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-25T21:16:24.550", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7267362"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1393"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0.0.3,26.0.0.3]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "WebSphere Application Server - Liberty", "source": "cna", "vendor": "IBM"}, "product": "websphere_application_server___liberty", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-03-30T18:31:08.831787+00:00", "value": {"mitigation_remediation": ["Apply the interim fix PH70078 following IBM's instructions.", "If the interim fix is not available, upgrade to fix pack 26.0.0.4 or later.", "Confirm the appSecurity features are correctly configured as described in IBM's guidance.", "After installation, review IBM instructions for post-fix steps and ensure the system is functioning.", "Monitor IBM support pages for further updates or additional interim fixes."], "summary": {"action": "Apply Patch", "impact": "Security Weakness"}, "threat_synthesis": {"affected_systems": "IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.3, specifically when the appSecurity-1.0 to appSecurity-5.0 features are enabled.", "description_and_impact": "This vulnerability allows administrators of IBM WebSphere Application Server Liberty to experience weaker than expected security when configuring security settings. The weakness, classified as CWE-1393, could lead to unauthorized configuration changes or other misuse of administrative controls, compromising the integrity of security enforcement within the application server.", "risk_and_exploitability": "The CVSS score of 6.7 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be local or privileged admin access, as the weakness emerges during administration of security settings. Official remediation requires applying an interim fix or a newer fix pack as directed by IBM."}}}}, "created": "2026-03-25T21:46:14.297939+00:00", "updated": "2026-03-30T20:57:53.964681+00:00", "vendors": ["ibm", "ibm$PRODUCT$websphere_application_server___liberty"]}