What is the CVSS score of CVE-2026-14515?

CVE-2026-14515 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14515?

Yes, a patch is available for CVE-2026-14515. Update the affected software to the latest version immediately.

IBM WebSphere Application Server CVE-2026-14515

EUVD-2026-50063 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-28 ibm

GHSA-83wp-8xg5-qprx

XSS IBM Websphere Application Server

6.1

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Reflected XSS requiring user interaction, low confidentiality and integrity impact on subsequent system.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:R/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 21:23 vuln.today

CVE Published

Jul 28, 2026 - 20:50 nvd

MEDIUM 6.1

DescriptionCVE.org

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.

AnalysisAI

Cross-site scripting in IBM WebSphere Application Server traditional 8.5 and 9.0 allows remote attackers to inject arbitrary JavaScript or HTML via reflected input. A crafted link clicked by an authenticated user can execute scripts in the victim's browser, leading to session hijacking or credential theft. No active exploitation or public exploit code is currently known, and a vendor patch is available.

Technical ContextAI

This failure to neutralize user-supplied input (CWE-79) occurs in the traditional profile of IBM WebSphere Application Server, a Java EE platform. Reflected XSS typically arises when error messages or dynamically generated pages echo unsanitized request parameters, allowing script execution in the security context of the trusted site. The affected product is identified by CPE cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*.

RemediationAI

Apply the vendor-supplied fix per IBM advisory https://www.ibm.com/support/pages/node/7281641; the advisory specifies patched versions. As a temporary workaround, restrict network access to the vulnerable web interface (likely the admin console) or implement a strict Content Security Policy (CSP) to limit script execution, noting that CSP may disrupt legitimate functionality. Web application firewall rules can filter XSS attempts but do not remove the underlying flaw.