CVE-2026-11712 is a cross-site scripting vulnerability (CWE-79) affecting IBM WebSphere Application Server versions 8.5 and 9.0. The flaw exists in the administrative console help system, where improper neutralization of input during web page generation allows injection of malicious scripts. The vulnerability has a CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating it can be exploited remotely without privileges but requires user interaction and results in complete confidentiality and integrity compromise within a scope-changed context. No official remediation or patch information is currently available from the vendor advisory or CVE data.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the administrative console help system, leading to high confidentiality and integrity impacts. This could result in unauthorized disclosure or modification of sensitive information accessible via the console. Availability impact is not affected. The vulnerability requires user interaction but no privileges, and the attack surface is network accessible.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to the administrative console help system to trusted users only and consider additional monitoring for suspicious activity involving the console. Avoid clicking on untrusted links or content that could trigger the vulnerability.