CVE-2026-14446 is a critical vulnerability in IBM WebSphere Application Server versions 8.5 and 9.0, categorized under CWE-306 (Missing Authentication for Critical Function). The flaw exists in the administrative console, where broken access control allows unauthenticated attackers to escalate privileges. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official remediation or patch from IBM as of the published date.

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized administrative access to the WebSphere Application Server, resulting in full compromise of the affected system. This includes the ability to view, modify, or delete sensitive data, disrupt services, and potentially pivot to other systems within the environment. The critical CVSS score reflects the high risk posed by this missing authentication control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the administrative console through network controls such as IP whitelisting or VPN access. Monitoring for unusual access patterns to the administrative interface is also advisable. Avoid exposing the administrative console to untrusted networks.