IBM WebSphere Application Server EUVD-2026-40396

Exploitation targets the administrative console help system of WebSphere Application Server 9.0 / 8.5 and requires a victim administrator to interact with attacker-supplied content (CVSS UI:R) - typically opening a crafted link or viewing injected help content while authenticated to the console. The attacker themselves needs no credentials on the server (PR:N), but the attack only yields value against a user who already has an active, privileged administrative console session; it does not grant standalone server access. Limiting factors: the required administrator interaction, the need for the target to be using the management console (not an end-user-facing application surface), and dependence on the specific vulnerable versions 9.0 and 8.5. This is therefore better suited to targeted social-engineering against operators than to broad, automated exploitation.

Signals conflict and warrant scrutiny. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N = 9.3 Critical) is unusually severe for an XSS issue: it asserts High confidentiality and integrity impact with a scope change, whereas typical reflected/console XSS is more accurately scored C:L/I:L. This vendor-assigned high score likely reflects the privileged admin-console context rather than direct server compromise, so the raw 9.3 probably overstates blast radius relative to a classic remote code execution. Mitigating factors lower real-world urgency: exploitation is unauthenticated against the server (PR:N) but still requires an administrator to be tricked into interacting with attacker content (UI:R), narrowing it to a social-engineering / targeted scenario rather than mass automated exploitation. No EPSS score, KEV listing, or POC was provided - there is no evidence of active exploitation. Net: treat as a meaningful but not emergency patch priority; the dependence on admin user interaction and absence of exploitation evidence place it below internet-facing pre-auth RCE despite the Critical label.

An attacker crafts a URL or content fragment containing a malicious script payload targeting the WebSphere administrative console help system and sends it to a WebSphere administrator (e.g., via phishing). When the authenticated administrator opens it in the console, the script executes in their session and can exfiltrate session tokens or issue console actions on their behalf. No public exploit code has been identified, and success depends on the administrator interacting with the crafted content.