CVE-2026-11707 is a cross-site scripting vulnerability (CWE-79) affecting IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server. The issue exists in the administrative console login page where user input is not properly sanitized, allowing an attacker to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating it can be exploited remotely without privileges but requires user interaction. The vulnerability impacts confidentiality and integrity with a scope change. No vendor advisory or patch is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected administrative console, potentially leading to theft or manipulation of sensitive information and unauthorized actions within the application. The vulnerability affects confidentiality and integrity but does not impact availability. The high CVSS score reflects the critical nature of this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider limiting access to the administrative console login page to trusted users only and employ web application firewalls or input validation controls where possible to mitigate the risk of exploitation.