CVE-2026-14528 affects IBM WebSphere Application Server 9.0 and 8.5 traditional editions. It allows a remote attacker to obtain sensitive information, classified under CWE-532 (Exposure of Sensitive Information). The CVSS v3.1 vector indicates the attack can be performed remotely over the network without privileges or user interaction but requires high attack complexity. The impact is high on confidentiality and integrity, with no impact on availability. No patch or remediation information is currently available, and no known exploits are reported in the wild.

An attacker exploiting this vulnerability could gain unauthorized access to sensitive information from the affected IBM WebSphere Application Server installations. This could compromise confidentiality and integrity of data handled by the server. There is no indication of impact on system availability. No known exploits have been reported, but the high severity rating suggests significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor IBM security advisories for updates. Until a fix is available, consider limiting network exposure of affected servers and applying any recommended vendor mitigations once published.