CVE-2026-11712: IBM WebSphere Application Server XSS in Administrative Console Help System
IBM has disclosed a cross-site scripting vulnerability in the administrative console help system of WebSphere Application Server 8.5 and 9.0. The CNA rates it critical with a CVSS 3.1 base score of 9.3, and the record lists affected ranges below 8.5.5.31 and 9.0.5.29. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.
Overview
IBM has published a vendor advisory for a cross-site scripting (XSS) weakness in the administrative console help system of IBM WebSphere Application Server 8.5 and 9.0. The record classifies it under CWE-79. This class of flaw can let attacker-controlled script run in a victim's browser when the vulnerable page is rendered.
Impact
- The CVSS 3.1 base score of 9.3 was supplied by the CNA (psirt@us.ibm.com) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.
- The vector indicates a network attack vector, low complexity, no privileges required, user interaction required, changed scope, high confidentiality and integrity impact, and no availability impact.
- In practice, a victim must interact with crafted content. The changed scope suggests the impact may extend beyond the vulnerable component.
Affected products and versions
- IBM WebSphere Application Server, versions 8.5.0.0 up to but excluding 8.5.5.31.
- IBM WebSphere Application Server, versions 9.0.0.0 up to but excluding 9.0.5.29.
- The record's fixes list is empty. The boundaries above are the recorded ranges, so confirm the exact fixed level in the IBM advisory.
Exploitation status
- The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted.
- EPSS estimate: probability 0.00384 and percentile 0.30591, dated 2026-10-13. This is a statistical likelihood estimate, not confirmation of exploitation.
Remediation and mitigation
- Review the IBM security bulletin linked in the references and identify the fixed level for your release line.
- Plan upgrades or fix pack installation for affected 8.5 and 9.0 installations, prioritizing internet-facing or widely used administrative consoles.
- Until patched, restrict access to the administrative console to trusted networks and administrators, and reduce exposure of the help system where feasible.
- Advise administrators not to follow untrusted links while signed in to the console.
Detection guidance
- At a high level, review web server and console access logs for unusual requests to help system paths or parameters containing script-like content.
- Monitor for unexpected administrative actions that follow user interactions with console pages.
- Maintain an inventory of WebSphere versions so affected instances can be identified quickly.
Limitations of the available information
- The record does not describe the vulnerable parameter, the exploitation prerequisites beyond the CVSS vector, or specific fixed version numbers.
- The record does not state whether the help system is enabled by default or in your configuration.
- This analysis relies only on the NVD, CVE Program and IBM references contained in the record.
Frequently asked questions
Is this CVE known to be exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. An EPSS estimate is provided, but it is a probability estimate, not confirmation.
Which versions are affected?
The record lists WebSphere Application Server 8.5.0.0 up to but excluding 8.5.5.31, and 9.0.0.0 up to but excluding 9.0.5.29. Check the IBM advisory for the exact fixed level for your release.
What should administrators do first?
Review the IBM advisory, plan an upgrade or fix pack for affected installations, and restrict access to the administrative console to trusted networks while patching is scheduled.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.