IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.
"}],"value":"IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-06-30T20:50:34.772Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7277546"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71757.
For IBM WebSphere Application Server traditional:
For V9.0.0.0 through 9.0.5.28:
· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71757
--OR--
· Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026).
For V8.5.0.0 through 8.5.5.29:
· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71757
--OR--
· Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).
Additional interim fixes may be available and linked off the interim fix download page.
"}],"value":"IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71757.\n\n\n\nFor IBM WebSphere Application Server traditional:\n\n\n\nFor V9.0.0.0 through 9.0.5.28:\n· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71757 https://www.ibm.com/support/pages/node/7277464 \n--OR--\n· Apply Fix Pack 9.0.5.29 or later (targeted availability 3Q2026). \n\n\n\nFor V8.5.0.0 through 8.5.5.29:\n· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71757 https://www.ibm.com/support/pages/node/7277464 \n--OR--\n· Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026). \n\n\n\n\n\n\n\nAdditional interim fixes may be available and linked off the interim fix download page."}],"title":"IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities","x_generator":{"engine":"ibm-cvegen"}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-11594","datePublished":"2026-06-30T20:50:34.772Z","dateReserved":"2026-06-08T14:06:40.450Z","dateUpdated":"2026-07-01T14:29:19.691Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-06-30 21:16:30","lastModifiedDate":"2026-07-02 17:57:37","problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-01T13:49:02.894633Z","id":"CVE-2026-11594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:*","versionStartIncluding":"8.5.0.0","versionEndExcluding":"8.5.5.30","matchCriteriaId":"08320FB1-F021-49EE-BD1F-E2A0D3A7B02B"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:*","versionStartIncluding":"9.0.0.0","versionEndExcluding":"9.0.5.29","matchCriteriaId":"2A4B3C11-FDA8-48D6-997F-48EEA8C3CB2C"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"11594","Ordinal":"1","Title":"IBM WebSphere Application Server is affected by multiple cross-s","CVE":"CVE-2026-11594","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"11594","Ordinal":"1","NoteData":"IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.","Type":"Description","Title":"IBM WebSphere Application Server is affected by multiple cross-s"}]}}}