CVE-2026-11708 is a critical cross-site scripting vulnerability (CWE-79) affecting IBM WebSphere Application Server versions 8.5 and 9.0. The flaw exists in the administrative console's integrated help system, where improper neutralization of input allows injection of malicious scripts. The vulnerability has a CVSS 3.1 base score of 9.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. No official fix or patch is currently documented, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the administrative console user, potentially leading to disclosure or modification of sensitive information. The vulnerability impacts confidentiality and integrity but does not affect availability. Since the administrative console is a high-privilege interface, exploitation could have significant security consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the administrative console to trusted users only and consider additional controls such as web application firewalls to detect and block malicious input targeting the integrated help system.