CVE-2026-11712 is a critical cross-site scripting vulnerability (CWE-79) affecting IBM WebSphere Application Server versions 8.5 and 9.0. The vulnerability exists in the administrative console help system, where improper neutralization of input allows injection of malicious scripts. The CVSS v3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality and integrity. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the administrative console, potentially leading to disclosure or modification of sensitive information accessible through the console. The confidentiality and integrity impacts are rated high, while availability is not affected. This could compromise administrative control and data confidentiality within the affected WebSphere Application Server environments.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to the administrative console to trusted users only and consider additional monitoring for suspicious activity related to the console. Avoid exposing the administrative console to untrusted networks.