CVE-2026-14974 affects IBM WebSphere Application Server 8.5 and 9.0 traditional editions. The vulnerability arises from unsafe deserialization practices that allow remote attackers to execute arbitrary code by sending crafted data to the server. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently provided, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could lead to complete compromise of the affected WebSphere Application Server instances, including unauthorized code execution, data disclosure, and service disruption. Given the high CVSS impact metrics, the vulnerability poses a significant risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the affected WebSphere Application Server instances and monitoring for suspicious activity related to deserialization inputs. Avoid exposing these servers directly to untrusted networks.