CVE-2026-11712: IBM WebSphere Application Server is affected by a cross-site scripting vulnerability

Synopsis

A cross-site scripting (XSS) vulnerability affects the administrative console help system in IBM WebSphere Application Server versions 9.0 and 8.5. The flaw is reachable over the network without any authentication, but requires a victim to interact with a crafted link or page, derived from the CVSS vector (AV:N, PR:N, UI:R). Successful exploitation gives an attacker full read and write access to content in the victim's browser session, scoped to the administrative console origin. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment IBM publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, so an attacker must be able to reach the WebSphere administrative console from an external or internal network position.

• AuthenticationNot required

  No account or credential is needed to deliver the malicious payload to the targeted user.

• Victim interactionRequired

  A victim must follow a crafted link or otherwise interact with attacker-controlled content in their browser for the XSS payload to execute.

• Attack complexityDetail

  The exploit is reliable and imposes no special environmental conditions, race conditions, or memory-layout requirements on the attacker.

Blast Radius

• An attacker can read the victim's active session tokens and any sensitive data visible in the administrative console.
• An attacker can issue state-changing requests within the console on behalf of the victim, including modifying server configuration or user permissions.
• Because the scope is changed (S:C in the CVSS vector), injected script can interact with resources outside the immediate application origin, widening the attack surface beyond the console itself.