CVE-2026-14446 affects IBM WebSphere Application Server 9.0 and 8.5, where broken access control in the administrative console permits privilege escalation. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function) and has a CVSS 3.1 base score vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently provided, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to escalate privileges within the administrative console, potentially leading to full administrative control over the affected WebSphere Application Server instance. This compromises confidentiality, integrity, and availability of the system and its hosted applications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the administrative console to trusted networks and users only, and monitor for any suspicious activity related to administrative access attempts.