Tivoli System Automation CVE-2026-11383

Exploitation requires an attacker to hold an authenticated account with at least low-privilege access to the IBM Tivoli System Automation Application Manager or WebSphere Application Server Administrative Console (confirmed by PR:L in the CVSS vector). A second user - the victim, typically a higher-privileged administrator - must actively view the page containing the injected payload (confirmed by UI:R in the CVSS vector). The administrative console must be network-accessible to the attacker (AV:N). Attack complexity is low (AC:L), meaning no race conditions, special timing, or non-default configurations are required beyond having a valid low-privilege console account. Exploitation is bounded by the requirement for prior authentication and mandatory victim interaction; unauthenticated or fully automated exploitation is not supported by the available CVSS data.

The CVSS 5.4 Medium rating is well-calibrated for this class of vulnerability. The vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N captures the key risk drivers: network-reachable admin console (AV:N), no special timing or race condition (AC:L), but requiring prior authentication at low privilege (PR:L) and a victim who must view the injected content (UI:R). The scope change (S:C) is the most significant factor elevating practical risk - a low-privileged attacker can affect administrator-level browser sessions. No EPSS score was provided in source data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC has been identified, suggesting this is not under active or widespread exploitation. Real-world prioritization should focus on environments where untrusted low-privileged users have any Administrative Console access alongside privileged administrators - that co-tenancy model is the critical risk prerequisite.

An attacker holding a low-privileged account on the IBM Tivoli System Automation Application Manager Administrative Console submits a crafted input containing a JavaScript payload into a console field that is subsequently rendered to other users. When a privileged administrator later navigates to the affected console page, the injected script executes in their browser, potentially exfiltrating the administrator's session cookie or performing privileged console actions on the attacker's behalf. No public POC has been identified at time of analysis, but the attack pattern is well understood and does not require specialized tooling.