IBM WebSphere EUVD-2026-40411

Exploitation targets the WebSphere Application Server administrative console specifically and requires three concrete conditions drawn from the CVSS vector: adjacent-network access to the console (AV:A - the attacker must be on the same logical network/segment, not arbitrary Internet), an authenticated administrator actively viewing the malicious content (UI:R - the privileged victim's browser interaction is what triggers script execution), and the admin console being deployed and reachable. Limiting factors that reduce realistic risk: it cannot be exploited fully remotely across the Internet without adjacency, it does not fire without a human administrator rendering the payload, and it is confined to environments running WAS 9.0 or 8.5 with the admin console exposed. PR:N indicates the attacker themselves need not authenticate to deliver the payload, but the high-value effect still hinges on an authenticated admin victim.

The supplied CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 8.5) presents an unusual profile for an XSS bug: it marks confidentiality and integrity as High with a changed scope, which is aggressive for a CWE-79 issue where impact is more typically Low. The vector also requires adjacent-network access (AV:A) and user interaction (UI:R) - a privileged administrator must view the malicious content - which materially constrains real-world exploitability versus a remote, no-interaction flaw. No EPSS score, SSVC decision, KEV listing, or POC was provided, so probabilistic exploitation signals are absent; the only confirmed external signals are CWE-79, the IBM-reported origin, and an available patch. Net assessment: this is a credible but interaction- and access-gated issue rather than a mass-exploitation priority - patch on a normal cycle and prioritize where the admin console is reachable from semi-trusted networks. Note the discrepancy: the High C/I impact and UI:R together imply admin-session compromise as the assumed worst case, which should be verified against IBM's advisory rather than treated as confirmed RCE-equivalent.

An attacker on the same adjacent network segment as the management interface crafts a request or stored value containing malicious JavaScript that the WebSphere admin console fails to neutralize. When an authenticated administrator views the affected console page, the script executes in their privileged session, allowing the attacker to steal the admin session token or perform actions as the administrator. No public POC was provided, and exploitation depends on the administrator interacting with the malicious content.