IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.

IBM WebSphere Application Server versions 9.0 and 8.5 are affected by a broken access control vulnerability that allows privilege escalation via the administrative console. This flaw could allow unauthorized users to gain elevated privileges within the application server environment. The vulnerability is tracked under CVE-2026-14446 and has been assigned a high criticality rating. IBM has published a support advisory with remediation guidance. Organizations running the affected versions should apply patches or mitigations as soon as possible to reduce risk of exploitation.