CVE-2026-11708: IBM WebSphere Application Server is affected by a cross-site scripting vulnerability

Synopsis

A cross-site scripting (XSS) vulnerability affects IBM WebSphere Application Server versions 9.0 and 8.5, specifically in the administrative console's integrated help system. The flaw is reachable over the network with no authentication required, but requires a victim to interact with a malicious link or page. Successful exploitation gives an attacker the ability to read sensitive data from the administrative console session and perform unauthorized actions within it, including modifying application server configuration. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as IBM publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WebSphere administrative console over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials are needed to craft or deliver the malicious payload that triggers the XSS.

• Victim interactionRequired

  A user with an active administrative console session must be socially engineered into clicking a malicious link or visiting an attacker-controlled page that triggers the injected script.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental configuration required on the attacker's side.

Blast Radius

• Reads session tokens, cookies, and any sensitive data visible within the administrative console of the affected WebSphere instance.
• Performs administrative actions on the application server (such as modifying deployed applications or server settings) under the identity of the authenticated victim.
• Exfiltrates data entered into the console during the victim's session, including credentials or configuration values.