IBM WebSphere CVE-2026-11708

Exploitation targets the administrative console's integrated help system in WebSphere Application Server 9.0 or 8.5, and requires that a privileged administrator view the attacker-influenced help content - the CVSS UI:R flag confirms required user interaction, which is the primary limiting factor. While the vector lists PR:N (no authentication needed to plant/deliver the payload), meaningful impact depends on an authenticated administrator being the one who renders the injected script in the console; exposure is further limited where the admin console is restricted to an isolated management network rather than broadly reachable. No special non-default product configuration is named in the description beyond use of the admin console help system.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) yields a 9.3 'Critical' score, but that rating is unusually high for a console help-system XSS and warrants scrutiny: the C:H/I:H impact ratings are aggressive for reflected/stored XSS, where realistic impact is typically limited to the victim admin's session (low confidentiality/integrity). The vector requires user interaction (UI:R), so exploitation is not automatable and depends on convincing or causing a privileged administrator to view crafted help content. No EPSS score, KEV listing, POC, or SSVC decision data was provided, all of which point away from imminent mass exploitation. Net assessment: a legitimate vulnerability worth patching given the privileged console context, but the 9.3 likely overstates real-world risk versus my independent assessment (see assessed vectors); treat as medium-priority unless your admin console is broadly accessible.

An attacker crafts a malicious input or link that, when processed by the administrative console's help system, injects JavaScript that executes in the browser of a logged-in WebSphere administrator who views the affected help page. Because the script runs in the privileged console context, it could steal the admin's session token or issue console requests on the admin's behalf. The attack requires that a privileged user actually interact with the malicious content (UI:R), and no public POC was identified at time of analysis.