IBM WebSphere Application Server versions 9.0 and 8.5, as well as IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8, are affected by a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability is triggered when the SIP container feature (sipServlet-1.1) is enabled. SSRF vulnerabilities can allow attackers to induce the server-side application to make HTTP requests to an arbitrary domain, potentially bypassing firewalls and accessing internal services. The vulnerability has been assigned CVE-2026-14529 and is catalogued in the NVD. IBM has published a support advisory with remediation guidance. Affected organizations should review whether the sipServlet-1.1 feature is enabled and apply patches or mitigations promptly. The high criticality rating reflects the potential for significant impact in enterprise environments running WebSphere.