CVE-2026-11708 is a critical cross-site scripting vulnerability (CWE-79) affecting IBM WebSphere Application Server versions 8.5 and 9.0. The vulnerability exists in the administrative console's integrated help system, where improper neutralization of input during web page generation allows injection of malicious scripts. The CVSS v3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality and integrity. No official patch or remediation guidance is currently available from IBM, and the vulnerability is not related to a cloud service.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the administrative console, potentially leading to unauthorized disclosure or modification of sensitive information. The vulnerability affects confidentiality and integrity but does not impact availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a patch is available, restrict access to the administrative console to trusted users only and consider additional monitoring for suspicious activity related to the integrated help system. Avoid exposing the administrative console to untrusted networks.