What is the CVSS score of CVE-2026-11712?

CVE-2026-11712 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of IBM WebSphere Application Server are affected by CVE-2026-11712?

IBM WebSphere Application Server 8.5 and 9.0 face a critical vulnerability that compromises administrative control through socially engineered links (no public exploit identified at time of…

How to fix or mitigate CVE-2026-11712?

24 hours: Segment administrative console access to authenticated internal networks only; apply firewall rules restricting access to known administrator IP ranges. 7 days: Implement Web Application Firewall rules to detect and block XSS payloads; enable detailed audit logging of all admin console sessions. 30 days: Assess administrative security practices and access controls; monitor IBM advisories for patch availability.

IBM WebSphere Application Server CVE-2026-11712

EUVD-2026-40396 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 psirt@us.ibm.com

GHSA-r8wf-c575-w3gq

XSS IBM Websphere Application Server

9.3

CVSS 3.1 · Vendor: us

Severity by source

Vendor (us) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

6.1 MEDIUM

Network-reachable reflected XSS needs no attacker auth (PR:N) but requires admin interaction (UI:R); script in another security context yields S:C with limited C:L/I:L, not the High impacts IBM assigned.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (us).

CVSS VectorVendor: us

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 20:35 vuln.today

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.

AnalysisAI

Cross-site scripting in IBM WebSphere Application Server 9.0 and 8.5 lets a remote attacker inject malicious script into the administrative console help system, which executes in the browser session of an administrator who is lured into viewing the crafted content. Because the payload runs inside an authenticated admin context, it can be abused to hijack the console session, manipulate configuration, or steal sensitive credentials. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires the victim administrator to interact with the malicious content (UI:R).

Technical ContextAI

WebSphere Application Server is IBM's flagship Java EE / Jakarta EE application server, widely used to host enterprise web and transactional workloads. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input rendered by the WebSphere administrative console help subsystem is not properly encoded or sanitized before being reflected back into HTML, allowing browser-interpreted script injection. The administrative (ISC) console is the privileged management interface for the server, so script executing within it runs with the trust and session of an authenticated WebSphere administrator. No CPE strings were supplied in the input; affected products are identified only from the textual version list (9.0 and 8.5).

RemediationAI

Apply the remediation described in IBM's security bulletin at https://www.ibm.com/support/pages/node/7278590, which is the authoritative source for the corrective fix pack or interim fix for WebSphere Application Server 9.0 and 8.5 - Patch available per vendor advisory; an exact fixed version string was not provided in the input data and should be taken directly from that bulletin rather than assumed. As compensating controls until patched: restrict network access to the administrative console (default secure port 9043) to a dedicated management network or VPN so it is not broadly reachable, which limits who can deliver a malicious link but does not protect administrators who already have console access; and operationally instruct administrators not to follow untrusted links into the console help system and to authenticate only via known-good console URLs, accepting that this human control is imperfect. These mitigations reduce exposure but do not eliminate the underlying unsanitized-output defect, so patching remains the durable fix.