IBM WebSphere Application Server Vulnerability Advisory (XSS/Info Disclosure)

Vulnerability Overview IBM WebSphere Application Server contains multiple vulnerabilities, including cross-site scripting (XSS) and path traversal vulnerabilities. The specific vulnerabilities are as follows: CVE-2026-11712: The admin console help system in IBM WebSphere Application Server is vulnerable to cross-site scripting. CVE-2026-11595: IBM WebSphere Application Server allows remote attackers to obtain sensitive information from the integrated help system of the admin console. CVE-2026-11708: The admin console integrated help system in IBM WebSphere Application Server is vulnerable to cross-site scripting. Affected Products The affected IBM WebSphere Application Server versions include: 9.0 8.5 Fix Solution IBM strongly recommends addressing the vulnerabilities by applying available interim fixes or fix packs, which contain the fix for APAR PH71756. After installing the interim fix or fix pack, please follow the additional provided instructions to complete the remediation. For IBM WebSphere Application Server Traditional: For V9.0.0.0 to V9.0.5.20: - Upgrade to the required interim fix pack level, then apply the interim fix that resolves PH71756. - Alternatively, apply Fix Pack 9.0.5.29 or higher (target availability 3Q2026). For V8.5.0.0 to V8.5.5.30: - Upgrade to the required interim fix pack level, then apply the interim fix that resolves PH71756, and strictly follow the instructions in PH71756. - Alternatively, apply Fix Pack 8.5.5.31 or higher (target availability 3Q2026), and strictly follow the instructions in PH71756. Additional Information Workarounds and Mitigations: None. References: - Complete CVSS v3 Guide - Online Calculator v3 Document Location Business Unit: IBM Software Product: WebSphere Application Server Component: NA Platform: AIX, Linux, Windows Version: 9.0.0.5, 8.5.5.31 Edition: Advanced, Base, Developer, Enterprise, Express, Network Deployment, Single Server Business Line: Automation Platform Document Information Modified Date: 2026-06-30 Initial Published Date: 2026-06-30 UID: ibm17278590 Need Support? Submit Feedback to IBM Support 1-800-IBM-7378 (USA) Global Contact Directory --- Note: POC code or exploitation code is not included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere Application Server Vulnerability Advisory (XSS/Info Disclosure)