CVE-2026-11383 is a cross-site scripting vulnerability in IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server's Administrative Console. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker with network access and low privileges to execute scripts via user interaction. The CVSS 3.1 vector indicates the attack requires user interaction and privileges but can lead to partial confidentiality and integrity impact without availability impact.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the Administrative Console, potentially leading to partial disclosure of sensitive information and modification of data within the application. There is no impact on system availability. The vulnerability requires the attacker to have low privileges and user interaction, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Users should monitor IBM's security advisories for updates and consider restricting access to the Administrative Console to trusted users until a patch is available.