CVE-2026-11708: IBM WebSphere Application Server XSS in Administrative Console Help System
CVE-2026-11708 is a cross-site scripting (XSS) flaw in the integrated help system of the administrative console of IBM WebSphere Application Server 8.5 and 9.0. IBM's CNA record assigns a CVSS 3.1 base score of 9.3 (Critical) with user interaction required. The sources consulted show no CISA KEV listing and no confirmed exploitation, and the record does not list an explicit fixed version.
Overview
The CNA record describes a cross-site scripting weakness (CWE-79) in the integrated help system of the administrative console of IBM WebSphere Application Server versions 8.5 and 9.0. The IBM vendor advisory is the primary reference for remediation details.
Impact
According to the CVSS 3.1 vector assigned by IBM PSIRT, the attack vector is network, no privileges are required, user interaction is required, the scope is changed, and the impact is high for confidentiality and integrity with no impact on availability. In general terms, XSS can allow script to run in the browser context of a user who views the affected page, which may include an administrator. This is an inference from the vulnerability class, not a stated outcome in the record.
Affected products and versions
- IBM WebSphere Application Server 8.5, from 8.5.0.0 up to but not including 8.5.5.31
- IBM WebSphere Application Server 9.0, from 9.0.0.0 up to but not including 9.0.5.29
The record does not list fixed versions. The upper bounds of the ranges suggest that 8.5.5.31 and 9.0.5.29 are the first versions outside the affected range, but this should be confirmed in the IBM advisory.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00384 with a percentile of 0.30591, dated 2026-10-13.
Remediation and mitigation
- Review the IBM support page at IBM support advisory and confirm the fix level that applies to your installed release.
- Plan upgrades to levels at or above the versions beyond the affected ranges, and prioritize administrative console deployments because the affected component belongs to the administrative interface.
- Limit access to the administrative console to trusted networks and named administrators, and avoid opening untrusted links while signed in to it.
- Where patching is delayed, apply any compensating controls recommended by the vendor advisory.
Detection guidance
- Review web server and administrative console logs for requests to help-system paths that contain unexpected script or markup in parameters.
- Monitor administrative sessions for unusual activity or configuration changes that follow suspicious browsing by administrators.
Limitations of the available information
The record does not provide explicit fixed version strings, the exact names of the affected help-system components, technical details of the flaw, or vendor-confirmed workarounds. The CVSS data comes from IBM PSIRT. Verify all version boundaries and remediation steps against the IBM advisory before acting.
Frequently asked questions
Which IBM WebSphere versions are affected by CVE-2026-11708?
The record lists IBM WebSphere Application Server from 8.5.0.0 up to but not including 8.5.5.31, and from 9.0.0.0 up to but not including 9.0.5.29.
Is CVE-2026-11708 known to be exploited?
The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted. Check the IBM advisory and KEV for later updates.
What should administrators do first?
Review the IBM advisory, confirm your installed fix level against the affected ranges, prioritize the administrative console, and restrict access to it while planning updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.