What is the CVSS score of CVE-2026-11708?

CVE-2026-11708 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-11708?

Within 24 hours: Conduct an inventory of all systems running WebSphere 9.0 and 8.5; implement network-level access controls restricting administrative console access to trusted administrative networks only; enable enhanced audit logging for all administrative console activity. Within 7 days: Deploy web application firewall (WAF) rules configured to block script injection patterns; implement network segmentation isolating administrative consoles from general user networks; establish real-time alerting for suspicious administrative activity. Within 30 days: Contact IBM support to confirm patch availability and timelines; develop and test upgrade strategy to patched WebSphere versions; perform security audit of administrative accounts and access logs for indicators of compromise.

IBM WebSphere CVE-2026-11708

EUVD-2026-40397 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 psirt@us.ibm.com

GHSA-6r45-rmg6-v6j9

XSS IBM Websphere Application Server

9.3

CVSS 3.1 · Vendor: us

Severity by source

Vendor (us) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

6.1 MEDIUM

Reflected/stored XSS needs a privileged admin to view the payload (UI:R) and realistically yields only limited session-scoped confidentiality/integrity impact (C:L/I:L), with scope change as script crosses into the admin context.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (us).

CVSS VectorVendor: us

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 20:34 vuln.today

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.

AnalysisAI

Cross-site scripting in IBM WebSphere Application Server 9.0 and 8.5 lets an attacker inject malicious script into the administrative console's integrated help system, which then executes in the browser of an administrator who views the affected page. Successful exploitation can hijack the admin session or perform actions in the console UI context. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, so risk is currently theoretical rather than actively exploited.

Technical ContextAI

WebSphere Application Server is IBM's enterprise Java EE/Jakarta EE application server, and the flaw lives in its web-based administrative console - specifically the integrated help subsystem that renders content in the admin's browser. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected or stored into help-system HTML without proper output encoding, allowing script injection. Because the console is the privileged management interface, script executing there runs in a high-trust context; the CVSS scope-changed flag (S:C) reflects that the injected script crosses from the vulnerable component into the administrator's authenticated session/browser context. No specific CPE strings were supplied beyond the affected version strings 9.0 and 8.5.

RemediationAI

Apply the vendor remediation described in IBM's advisory at https://www.ibm.com/support/pages/node/7278590; the input does not specify an exact patched fixpack version, so this is best characterized as a patch available per vendor advisory - confirm the precise interim fix or fixpack level (for the 9.0 and 8.5 streams) directly from that page rather than assuming a version number. As compensating controls until patched, restrict network access to the administrative console to a trusted management network or jump host (the console should never be internet-facing), enforce that administrators do not browse untrusted links while authenticated to the console, and consider disabling or limiting use of the integrated help subsystem if your operational procedures allow - the trade-off being reduced in-console documentation access for administrators.