What is the CVSS score of CVE-2026-11372?

CVE-2026-11372 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-11372?

Yes, a patch is available for CVE-2026-11372. Update the affected software to the latest version immediately.

IBM TRIRIGA CVE-2026-11372

EUVD-2026-38280 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-22 ibm

GHSA-h4m9-g3gq-cc2g

XSS IBM Tririga Application Platform

5.4

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires a victim to view the page (UI:R), and script execution in victim's browser constitutes a scope change (S:C); PR:L reflects mandatory authenticated injection.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 16:06 vuln.today

DescriptionNVD

IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

AnalysisAI

Stored cross-site scripting in IBM TRIRIGA Application Platform 5.0.2 and 5.0.3 allows an authenticated low-privileged user to inject arbitrary JavaScript into the Web UI, which executes in the browser context of other users who view the affected page - enabling session hijacking and credential theft within trusted sessions. No public exploit code has been identified at time of analysis, and IBM has released a patch via their support advisory. The CVSS score of 5.4 (Medium) reflects the authentication prerequisite and limited direct impact scope, though the credential disclosure risk elevates practical severity for privilege-escalation scenarios.

Technical ContextAI

IBM TRIRIGA Application Platform is an enterprise Integrated Workplace Management System (IWMS) used for real estate, facility, and asset management. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning user-supplied input is rendered back into web pages without adequate sanitization or output encoding. Affected CPE is cpe:2.3:a:ibm:tririga_application_platform:*:*:*:*:*:*:*:* covering the 5.0.2-5.0.3 release range. The CVSS vector AV:N/AC:L/PR:L indicates the injection vector is network-accessible via a web browser and requires only low-privilege credentials, consistent with a stored XSS flaw in a user-editable form or field within the TRIRIGA Web UI. The lack of output encoding allows injected script tags or event handlers to persist in the application database and be served to subsequent visitors.

RemediationAI

Apply the vendor-released patch as described in IBM's support advisory at https://www.ibm.com/support/pages/node/7276076. The advisory was self-reported by IBM, confirming patch availability, though an exact fixed version number was not provided in the available intelligence and should be confirmed from the advisory directly before deployment. If immediate patching is not feasible, restrict access to the TRIRIGA Web UI to trusted internal networks or VPN users to reduce exposure to injection by low-privilege insiders. Additionally, enforce Content Security Policy (CSP) headers at the reverse proxy or load balancer layer to restrict inline script execution - note this may impact legitimate TRIRIGA UI functionality and should be tested in staging first. Audit TRIRIGA user accounts to ensure the principle of least privilege limits who can write to user-editable fields in the Web UI.