Cyber Posture

CVE-2025-14923

Medium

Published: 03 March 2026

Published
03 March 2026
Modified
04 March 2026
KEV Added
Patch
CVSS Score 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0003 10.5th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14923 is a medium-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Ibm Websphere Application Server. Its CVSS base score is 4.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 10.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Credentials In Files (T1552.001) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-798 CWE-321

Supplier evaluation and secure acquisition practices make it harder for hard-coded credentials to be introduced via procured products.

addresses: CWE-798 CWE-321

Requiring security functional requirements and acceptance criteria allows contracts to prohibit hard-coded credentials in delivered systems or components.

addresses: CWE-798 CWE-321

Supplier risk reviews identify and discourage hard-coded credentials in delivered products or services.

addresses: CWE-798

Enables users to notice when hard-coded credentials have been exploited for unauthorized access.

addresses: CWE-798

Security training explicitly warns against hard-coded credentials, lowering their use in systems.

addresses: CWE-798

Policy and procedures prohibit hard-coded credentials in favor of managed authentication.

addresses: CWE-798

External identity providers eliminate the need for hard-coded credentials in applications.

addresses: CWE-798

Changing default authenticators prior to first use and protecting content prevents use of hard-coded credentials.

MITRE ATT&CK Enterprise TechniquesAI

T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

Hard-coded keys/credentials in Security Utility directly enable local extraction of sensitive security config data (T1552.001); vulnerability permits unauthorized local data access (T1005).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.

Deeper analysisAI

CVE-2025-14923 is a security vulnerability in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.2. It results in weaker than expected security when using the Security Utility to administer security settings. The issue maps to CWE-321 (Use of Hard-coded Cryptographic Key) and CWE-798 (Use of Hard-coded Credentials), with a CVSS v3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

An attacker requires local access to the system, low privileges, and must overcome high attack complexity, with no user interaction required. Successful exploitation enables high-impact unauthorized disclosure of confidential information, such as sensitive security configuration data, but does not affect integrity or availability.

IBM provides details on mitigation and patches in its security advisory at https://www.ibm.com/support/pages/node/7261761.

Details

CWE(s)

Affected Products

ibm
websphere application server
17.0.0.3 — 26.0.0.3

CVEs Like This One

CVE-2025-14914Same product: Ibm Websphere Application Server
CVE-2026-0977Same vendor: Ibm
CVE-2025-13108Same vendor: Ibm
CVE-2025-33089Same vendor: Ibm
CVE-2025-1722Same vendor: Ibm
CVE-2026-4788Same vendor: Ibm
CVE-2024-41770Same vendor: Ibm
CVE-2024-41771Same vendor: Ibm
CVE-2025-13096Same vendor: Ibm
CVE-2025-0162Same vendor: Ibm

References