IBM WebSphere Application Server versions 9.0 and 8.5 traditional are affected by a critical pre-authentication unsafe deserialization vulnerability. The flaw allows remote attackers to bypass authentication or execute arbitrary code without prior credentials. This makes it particularly dangerous as no user interaction or authentication is required to exploit it. The vulnerability impacts widely deployed enterprise Java application server software. IBM has published a support advisory with remediation guidance. The issue is tracked as CVE-2026-14512 and has been assigned a high criticality rating. Organizations running affected versions should apply patches immediately to reduce exposure risk.