What is the CVSS score of CVE-2026-16186?

CVE-2026-16186 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-16186?

Yes, a patch is available for CVE-2026-16186. Update the affected software to the latest version immediately.

IBM WebSphere Application Server CVE-2026-16186

EUVD-2026-78053 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-14 ibm

GHSA-5qgm-27g5-r78f

XSS IBM Websphere Application Server

5.4

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Reflected XSS is network-delivered with no attacker privileges but requires victim interaction; scope unchanged limits impact to C:L/I:L with no availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 07:42 vuln.today

CVE Published

Sep 14, 2026 - 19:58 nvd

MEDIUM 5.4

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability.

AnalysisAI

Reflected cross-site scripting in IBM WebSphere Application Server 8.5 and 9.0 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted link to the vulnerable server. Successful exploitation can lead to session token theft, credential harvesting, or unauthorized actions performed under the victim's browser context. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that a victim user with an active browser session to the WebSphere application follow a specially crafted URL delivered by the attacker - user interaction (UI:R) is mandatory and is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 5.4 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) accurately reflects the moderate real-world risk profile: the attack is network-reachable and requires no attacker privileges, but mandates user interaction, capping the realistic threat at phishing or social-engineering scenarios. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	IBM has released a patch for this vulnerability; administrators should apply the vendor-provided fix documented in the IBM security bulletin at https://www.ibm.com/support/pages/node/7286610. … Detailed patch versions, workarounds, and compensating controls in full report.