Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

IBM WebSphere Application Server Admin Console XSS Risk

CVE-2026-11594 · published 4 months ago
Summary

IBM WebSphere Application Server's admin console is vulnerable to malicious code injection. This means an attacker could trick users into executing malicious scripts. Update to the latest version to protect your server.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm websphere_application_server >= 8.5.0.0, < 8.5.5.30
>= 9.0.0.0, < 9.0.5.29
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:*
Original advisory text
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published30 Jun 2026
Updated4 Nov 2026
First seen30 Jun 2026
Sources
CVE-2026-11594 · NVD
Track software like this
Free during beta