CVE-2026-14529 is a critical vulnerability in IBM WebSphere Application Server 8.5 and 9.0 related to CWE-306 (Missing Authentication for Critical Function). The issue arises when the SIP container feature (sipServlet-1.1) is enabled, allowing unauthenticated attackers to perform server-side request forgery (SSRF). This can lead to unauthorized access or manipulation of internal resources. The CVSS 3.1 base score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity, with low impact on availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated remote attackers to perform SSRF attacks, potentially leading to unauthorized disclosure and modification of sensitive information within the affected IBM WebSphere Application Server instances. The impact is rated high for confidentiality and integrity, and low for availability. This could compromise critical server functions if the SIP container feature is enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, administrators should consider disabling the SIP container feature (sipServlet-1.1) if it is not required, and monitor IBM's advisories for updates. Avoid exposing vulnerable versions to untrusted networks until a fix is available.