CVE-2026-11372 is a cross-site scripting vulnerability in IBM TRIRIGA Application Platform versions 5.0.2 and 5.0.3. It arises from improper neutralization of input during web page generation, allowing authenticated users to embed arbitrary JavaScript code in the web UI. This can alter intended functionality and may lead to credential disclosure within a trusted session. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting a medium severity level. No official patch or remediation guidance has been published by IBM at this time.

An authenticated user can exploit this vulnerability to inject malicious JavaScript code into the web interface, potentially compromising the confidentiality of user credentials within an active session. This could lead to unauthorized actions performed under the context of the trusted session. There is no indication of impact on system availability or integrity beyond the described credential disclosure risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to trusted authenticated users and monitor for unusual activity related to web interface usage. Avoid executing untrusted scripts or input in the affected versions. IBM has not provided an official remediation or temporary fix as of the published date.