What is the CVSS score of CVE-2026-11594?

CVE-2026-11594 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere are affected by CVE-2026-11594?

IBM WebSphere Application Server (versions 8.5 and 9.0) contains a script injection vulnerability in the administrative console that enables attackers to impersonate system administrators and gain…. A patch is available.

How to fix or mitigate CVE-2026-11594?

Within 24 hours: Inventory all WebSphere Application Server 8.5 and 9.0 instances; document network exposure of admin consoles; review access logs for unauthorized admin activity. Within 7 days: Apply vendor patches to all WebSphere instances (confirm specific patch version with IBM advisory for your WAS version). Within 30 days: Complete patch verification across all instances; implement network-level restrictions on admin console access; conduct access control audit.

IBM WebSphere CVE-2026-11594

EUVD-2026-40411 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 ibm

GHSA-ggxw-vx9j-j3mp

XSS IBM Websphere Application Server

6.1

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

XSS in an admin console typically yields Low C/I with changed scope; injecting into the console generally needs some access (PR:L) and an admin victim must render it (UI:R).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 02, 2026 - 18:07 NVD

HIGH MEDIUM

CVSS changed

Jul 02, 2026 - 18:07 NVD

8.5 (HIGH) 6.1 (MEDIUM)

Analysis Generated

Jun 30, 2026 - 21:16 vuln.today

DescriptionNVD

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.

AnalysisAI

Stored/reflected cross-site scripting in the administrative console of IBM WebSphere Application Server 9.0 and 8.5 lets an adjacent-network attacker inject malicious script that executes in an administrator's browser session. Because the CVSS scope is changed and impact is rated high, a successful injection could let the attacker hijack the privileged admin session and pivot to broader server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.

Technical ContextAI

IBM WebSphere Application Server (WAS) is a Java EE/Jakarta EE enterprise application server used to host business-critical web applications; the affected component is its browser-based administrative (ISC) console used by operators to configure and manage the cell. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input rendered in the admin console is not properly encoded/escaped before being returned in an HTML response, allowing arbitrary JavaScript to run in the context of the console origin. The single CPE provided, cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*, is wildcarded and does not by itself delimit the affected version range, but IBM's text scopes it to the 9.0 and 8.5 release lines.

RemediationAI

Apply the fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7277546 (Patch available per vendor advisory); an exact fix pack / iFix version was not included in the provided data, so confirm the specific APAR/iFix for your 9.0 or 8.5 install directly from that note before scheduling. As compensating controls until patched, restrict network reachability of the administrative console to a dedicated management VLAN or jump host and block it from general user/adjacent networks (trade-off: administrators must connect via the management path), enforce that admins use a separate hardened browser/session and avoid following untrusted links while authenticated to the console (trade-off: operational friction), and consider enabling/ tightening administrative security and session timeouts to shrink the window for session hijack (trade-off: more frequent re-authentication). These mitigations reduce who can deliver the payload and limit blast radius but do not remove the underlying flaw.