CVE-2026-11594 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability affecting IBM WebSphere Application Server versions 8.5 and 9.0. It allows cross-site scripting attacks through the administrative console, potentially enabling an attacker to execute arbitrary scripts in the context of the affected application. The CVSS v3.1 base score is 8.5, indicating high severity with attack vector as adjacent network, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity but no impact on availability. The vendor has not published any patch or official remediation at this time.

Successful exploitation of this vulnerability could lead to unauthorized disclosure and modification of sensitive information within the administrative console of IBM WebSphere Application Server 8.5 and 9.0. The vulnerability does not impact availability but compromises confidentiality and integrity, potentially allowing attackers to perform actions with the privileges of the affected user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the administrative console to trusted users only and consider additional monitoring of administrative activities. Avoid clicking on untrusted links or opening suspicious content that could trigger the XSS vulnerability.