Tivoli System Automation CVE-2026-11707

Exploitation requires the attacker to deliver a crafted link/parameter targeting the administrative console login page of Tivoli System Automation Application Manager 4.1 and to convince a console user to open it (UI:R is present in the CVSS vector). No pre-existing authentication is needed by the attacker (PR:N), but the login page must be network-reachable by the victim and the victim must interact with the malicious request. Limiting factors: the user-interaction requirement means it cannot be exploited fully unattended, and if the admin console is confined to an isolated management network the reachable attack surface is sharply reduced.

Signals are mixed and warrant scrutiny. The CVSS base score of 9.3 is driven almost entirely by the scope-change flag (S:C) combined with the vendor's rating of C:H/I:H - an unusually high impact rating for a reflected XSS, where confidentiality/integrity impact is typically Low. This is a likely case of a high headline score that overstates real-world severity: XSS on a login page generally enables session/credential theft or UI manipulation against a user who is socially engineered into clicking a malicious link (UI:R), not direct system compromise. No EPSS score was supplied, so exploitation probability cannot be quantified; there is no KEV listing and no POC referenced, so there is no evidence of active or public exploitation. The realistic priority is moderate: patch in a normal cycle rather than emergency unless the console is internet-exposed. Note the discrepancy: verify the C:H/I:H impact rating against IBM's advisory, as it is atypically high for this vulnerability class.

An attacker crafts a URL to the Tivoli/WebSphere admin console login page with a malicious script payload embedded in a reflected parameter, then delivers it to an administrator via phishing email or a chat message. When the administrator clicks the link while the console is reachable, the script executes in their browser within the console's trusted origin, enabling session cookie theft, credential capture from the login form, or forged administrative actions. No public exploit is identified at time of analysis, and success depends on the victim opening the crafted link (UI:R).