CVE-2026-11594 is a cross-site scripting vulnerability (CWE-79) affecting IBM WebSphere Application Server versions 9.0 and 8.5. The issue exists in the administrative console where input is not properly neutralized during web page generation, allowing an attacker to execute arbitrary scripts in the context of the application. The CVSS 3.1 base score is 8.5, reflecting high impact on confidentiality and integrity, with attack vector being adjacent network, low attack complexity, no privileges required, user interaction required, and scope changed. No official patch or remediation level has been published at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the administrative console, potentially leading to disclosure or modification of sensitive information. The vulnerability impacts confidentiality and integrity but does not affect availability. The attack requires user interaction and can be performed remotely over an adjacent network without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when accessing the administrative console and consider limiting access to trusted users and networks. Monitor IBM advisories for updates regarding patches or official mitigations.