EUVD-2026-50063
GHSA-83wp-8xg5-qprx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious link with XSS payload
-
ExploitVictim clicks the link
-
ExecutionInjected script executes in browser
-
ImpactSession token stolen or actions performed on victim's behalf.
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User interaction (UI:R) is mandatory-the victim must click a malicious link. No authentication is needed to deliver the link (PR:N), but the victim must be authenticated to the WebSphere application for the exploit to impact sensitive operations. The description does not indicate non-default configuration requirements, so the default traditional deployment is assumed vulnerable. |
| Impact | CVSS 3.1 score 6.1 (Medium) with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates network-accessible, low-complexity attack requiring user interaction. No EPSS score available to gauge exploitation probability; no CISA KEV listing confirms no known active exploitation. SSVC analysis: automatable but no exploitation detected, partial technical impact. Real-world risk is moderate-it demands phishing and authenticated victims; a patch exists, reducing urgency. |
| Exploit ScenarioDerived | An attacker sends a phishing email containing a specially crafted URL to an administrator. When the admin clicks the link while authenticated to WebSphere, embedded JavaScript executes in their browser, possibly exfiltrating session cookies or performing administrative actions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Cross-site scripting in IBM WebSphere Application Server traditional 8.5 and 9.0 allows remote attackers to inject arbitrary JavaScript or HTML via reflected input. A crafted link clicked by an authenticated user can execute scripts in the victim's browser, leading to session hijacking or credential theft. No active exploitation or public exploit code is currently known, and a vendor patch is available.
RemediationAI
Apply the vendor-supplied fix per IBM advisory https://www.ibm.com/support/pages/node/7281641; the advisory specifies patched versions. As a temporary workaround, restrict network access to the vulnerable web interface (likely the admin console) or implement a strict Content Security Policy (CSP) to limit script execution, noting that CSP may disrupt legitimate functionality. Web application firewall rules can filter XSS attempts but do not remove the underlying flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This failure to neutralize user-supplied input (CWE-79) occurs in the traditional profile of IBM WebSphere Application Server, a Java EE platform. Reflected XSS typically arises when error messages or dynamically generated pages echo unsanitized request parameters, allowing script execution in the security context of the trusted site. The affected product is identified by CPE cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*.
Know when Websphere Application Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS requiring user interaction, low confidentiality and integrity impact on subsequent system.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Websphere Application Server
View allIBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Co
Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown i
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unau
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Libe
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network at
HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 thr
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Serv
Exploit-DB