CVE-2026-16186 is a reflected cross-site scripting vulnerability (CWE-79) in IBM WebSphere Application Server versions 8.5 and 9.0. The flaw arises from improper neutralization of input during web page generation, enabling an attacker to inject malicious scripts that execute in the context of the victim's browser session. This can lead to limited confidentiality and integrity impacts but does not affect availability. The vulnerability requires no privileges and can be triggered via user interaction (UI required).

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a user's browser session, potentially leading to information disclosure and modification of data accessible to the user. There is no impact on system availability. The vulnerability does not require authentication and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor IBM's advisories for updates and apply patches once available. Until then, consider implementing web application firewalls or input validation as temporary mitigations if feasible.