What is the CVSS score of EUVD-2026-51141?

EUVD-2026-51141 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-51141?

Within 24 hours, identify all systems running Tivoli 4.1 in your environment and alert system administrators to avoid clicking untrusted links targeting the administrative console, then review and restrict network access to the admin interface where feasible. Within 7 days, obtain the vendor-released patch, test it thoroughly in a staging environment, and schedule deployment to all affected production systems during your next approved change window. Within 30 days, verify patch deployment across your complete inventory of Tivoli 4.1 instances using automated compliance scanning and confirm no unpatched systems remain in production.

Tivoli System Automation EUVD-2026-51141

Q: Which versions of Tivoli System Automation are affected by EUVD-2026-51141?

IBM Tivoli System Automation Application Manager 4.1 contains a critical reflected cross-site scripting vulnerability in the administrative console that allows attackers to execute arbitrary code…. A patch is available.

| CVE-2026-11707 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 ibm

GHSA-wqwm-6mc2-j593

XSS IBM Tivoli System Automation Application Manager

9.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

6.1 MEDIUM

Standard reflected XSS: network vector, no auth but requires victim click (UI:R), scope change into the browser origin, with Low confidentiality/integrity impact rather than High.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:28 vuln.today

CVE Published

Jul 30, 2026 - 14:15 nvd

CRITICAL 9.3

DescriptionCVE.org

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.

AnalysisAI

Reflected cross-site scripting in the administrative console login page of IBM Tivoli System Automation Application Manager 4.1 (a component that also involves IBM WebSphere Application Server) allows a remote attacker to inject and execute arbitrary script in an administrator's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R, scope-changed) yields a high 9.3 base score, but exploitation requires tricking an authenticated console user into loading a crafted URL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.

Technical ContextAI

The affected component is the WebSphere-based administrative console shipped with IBM Tivoli System Automation Application Manager, an enterprise product used to orchestrate high-availability and disaster-recovery automation across IBM middleware. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): user-controllable input reflected on the console login page is not properly sanitized or output-encoded, so an attacker-supplied string is rendered as active HTML/JavaScript in the browser. Because the login page runs within the trusted WebSphere admin console origin, injected script executes with the privileges of that origin. The single CPE provided, cpe:2.3:a:ibm:tivoli_system_automation_application_manager:*, identifies the product but does not pin exact version boundaries beyond the '4.1' cited in the description.

RemediationAI

Apply the fix referenced in IBM's security bulletin at https://www.ibm.com/support/pages/node/7281073 (Patch available per vendor advisory); the provided data does not include an exact patched version string, so obtain the precise fix pack or interim fix level from that advisory before deployment. As compensating controls until patching, restrict network access to the administrative console to a trusted management VLAN or via VPN/jump host so the login page cannot be reached by untrusted users, and place a WAF or reverse proxy rule in front of the console to filter reflected script in login-page parameters (side effect: may block legitimate special characters in credentials). Because exploitation requires user interaction, also advise administrators not to follow console links from untrusted sources, and consider enabling a strict Content-Security-Policy on the console origin if the WebSphere configuration permits (side effect: can break legacy inline scripts in the console UI).