IBM has disclosed several security vulnerabilities in its WebSphere Application Server that put enterprise environments at risk of cross-site scripting (XSS) and path-traversal attacks.
These vulnerabilities could allow attackers to compromise administrative sessions and access sensitive data. The issues, identified as CVE-2026-11712, CVE-2026-11595, and CVE-2026-11708, affect widely deployed versions 8.5 and 9.0 of the application server, raising concerns for organizations that rely on WebSphere for critical business applications.
According to IBM’s official security bulletin, two of the vulnerabilities are high-severity XSS flaws involving the administrative console’s integrated help system.
These flaws arise from improper input neutralization (CWE-79), which enables malicious scripts to be injected and executed in the victim’s browser. Both CVE-2026-11712 and CVE-2026-11708 have a CVSS base score of 9.3, indicating they represent critical risks.
Successful exploitation requires minimal user interaction; for instance, an administrator might access a crafted link, after which attackers can hijack sessions, manipulate data, or perform unauthorized actions within the console.
The third vulnerability, CVE-2026-11595, is a path traversal issue within the same help system component, classified under CWE-22. This flaw could allow a remote attacker to access restricted files and obtain sensitive information.
Although its CVSS score is lower at 4.3, it still poses a risk in environments where the administrative interface is exposed or inadequately protected.
Details of the vulnerabilities are as follows:
All three vulnerabilities affect IBM WebSphere Application Server versions 9.0 and 8.5, which are widely used in enterprise environments. Given WebSphere’s role in hosting mission-critical applications, exploits could lead to significant operational and data security impacts, particularly if attackers gain administrative-level access.
IBM has released remediation guidance and strongly urges customers to apply the fixes immediately. The company recommends applying interim fixes associated with APAR PH71756 or upgrading to upcoming fix packs.
For WebSphere 9.0, users should upgrade to Fix Pack 9.0.5.29 or later; users of version 8.5 are advised to upgrade to Fix Pack 8.5.5.31 or later. Interim fixes are currently available and should be applied alongside specific post-installation steps outlined by IBM to ensure complete remediation.
Security experts warn that administrative interfaces are frequent targets for attackers, and vulnerabilities in these components significantly increase exposure to risk. Organizations are advised to restrict access to administrative consoles, enforce strong authentication controls, and monitor for suspicious activity while patching is underway.
As active exploitation of web-based vulnerabilities continues to rise, timely patching and proactive security measures remain crucial in defending enterprise infrastructure against evolving threats.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…