CVE-2025-14923
Published: 03 March 2026
Summary
CVE-2025-14923 is a medium-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Ibm Websphere Application Server. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 10.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Supplier evaluation and secure acquisition practices make it harder for hard-coded credentials to be introduced via procured products.
Requiring security functional requirements and acceptance criteria allows contracts to prohibit hard-coded credentials in delivered systems or components.
Supplier risk reviews identify and discourage hard-coded credentials in delivered products or services.
Enables users to notice when hard-coded credentials have been exploited for unauthorized access.
Security training explicitly warns against hard-coded credentials, lowering their use in systems.
Policy and procedures prohibit hard-coded credentials in favor of managed authentication.
External identity providers eliminate the need for hard-coded credentials in applications.
Changing default authenticators prior to first use and protecting content prevents use of hard-coded credentials.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hard-coded keys/credentials in Security Utility directly enable local extraction of sensitive security config data (T1552.001); vulnerability permits unauthorized local data access (T1005).
NVD Description
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.
Deeper analysisAI
CVE-2025-14923 is a security vulnerability in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.2. It results in weaker than expected security when using the Security Utility to administer security settings. The issue maps to CWE-321 (Use of Hard-coded Cryptographic Key) and CWE-798 (Use of Hard-coded Credentials), with a CVSS v3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).
An attacker requires local access to the system, low privileges, and must overcome high attack complexity, with no user interaction required. Successful exploitation enables high-impact unauthorized disclosure of confidential information, such as sensitive security configuration data, but does not affect integrity or availability.
IBM provides details on mitigation and patches in its security advisory at https://www.ibm.com/support/pages/node/7261761.
Details
- CWE(s)