IBM WebSphere Application Server versions 8.5 and 9.0 contain a vulnerability (CVE-2026-14528) where sensitive information may be inserted into log files. This flaw could be exploited remotely without authentication, potentially allowing an attacker to access confidential data through the logs. The vulnerability is categorized as CWE-532 (Insertion of Sensitive Information into Log File). The CVSS v3.1 base score is 7.4, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch available at this time.

An attacker could remotely obtain sensitive information from the affected IBM WebSphere Application Server by exploiting the improper logging of sensitive data. This could lead to disclosure of confidential information and compromise of data integrity. There is no indication of impact on system availability. The vulnerability does not require privileges or user interaction to exploit, but has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should review logging configurations and avoid logging sensitive information if possible. Monitor IBM advisories for updates and apply patches promptly once available.