WebSphere Application Server CVE-2026-11538

Exploitation requires that the target WebSphere Application Server (9.0 or 8.5) processes LTPA token authentication and writes token/cookie content to its logs - the attacker supplies a crafted LTPA token cookie over the network without authentication (PR:N). The impact is limited to log integrity (forged/injected log entries); there is no confidentiality or availability impact and no code execution. Realistic risk is further limited by AC:H - the attacker needs to craft content that survives into logs in an exploitable form, and the damage only materializes when those logs are consumed by a human or downstream system that misinterprets the injected entries.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly reflects that the only impact is a Low integrity effect (I:L) - no confidentiality or availability loss - consistent with CWE-117 (Improper Output Neutralization for Logs), i.e. log injection, not code execution. The AC:H reflects that reliably forging useful log content and having it viewed/parsed downstream is not trivial. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is: no public exploit identified at time of analysis. There are no conflicting signals here: all sources agree this is a low-severity log-tampering weakness, not a high-CVSS-but-hidden-risk case. The main caveat is that the input Tags label this 'Code Injection', which overstates the impact - this is log injection (CWE-117), which cannot on its own yield code execution. A patch is available from IBM (support node 7286610).

A remote, unauthenticated attacker sends HTTP requests to a WebSphere endpoint with a crafted LTPA token cookie containing embedded control characters (e.g. CRLF or fake log-line markers). When WebSphere writes the cookie/token value to its logs without neutralization, the attacker forges or splits log entries - potentially hiding activity or planting misleading records for anyone (or any SIEM) reading the logs. No public exploit code is identified, and the CVSS AC:H indicates non-trivial conditions for reliable, impactful injection.