CVE-2026-11712

CriticalCVSS 9.3

Published: 30/06/2026(UTC)Updated: 02/07/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile — higher than 12% of all known CVEs

Summary

IBM WebSphere Application Server 9.0 and 8.5 are affected by a cross-site scripting (XSS) vulnerability in the administrative console help system. This allows an attacker to inject malicious scripts into the help page.

Risk Assessment

The risk involves potential theft of administrative sessions, account takeover, or unauthorized actions within the application server management console.

Recommendation

It is recommended to immediately update IBM WebSphere Application Server to the latest patched version and restrict access to the administrative console to trusted IP addresses only.

Original NVD description (English source)

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.