CVE-2026-14980 describes a vulnerability in IBM WebSphere Application Server - Liberty, specifically version 17.0.0.3, where improper privilege management leads to a cross-site request forgery (CSRF) issue. When the collectiveController-1.0 feature is enabled, this CSRF vulnerability can be exploited to perform server-side request forgery (SSRF) attacks with elevated privileges. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is needed. Successful exploitation results in high confidentiality and integrity impact, and low availability impact. No vendor advisory or patch is currently available to address this issue.

An attacker can exploit the CSRF vulnerability to perform SSRF attacks with elevated privileges, potentially leading to unauthorized access or manipulation of sensitive data and system functions. The impact includes high confidentiality and integrity compromise and low availability impact. This could allow attackers to bypass normal access controls and perform actions on behalf of legitimate users or the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the collectiveController-1.0 feature if it is not required, and apply strict access controls and monitoring to limit exposure. Follow IBM's official guidance once available.