CVE-2026-14515 is a CWE-79 cross-site scripting vulnerability affecting IBM WebSphere Application Server versions 8.5 and 9.0 traditional. The vulnerability arises from improper neutralization of input during web page generation, which could allow a remote attacker to execute arbitrary scripts in the context of the affected application. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow a remote attacker to perform cross-site scripting attacks, potentially leading to the execution of malicious scripts in users' browsers. This may result in limited confidentiality and integrity impacts, such as theft of user session tokens or manipulation of web content. There is no impact on system availability. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying web application firewalls or input validation controls as temporary mitigations. Monitor IBM's security advisories for updates regarding patches or official mitigations.