CVE-2026-2485 is a stored cross-site scripting vulnerability (CWE-79) affecting IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6. The vulnerability permits a privileged user to embed arbitrary JavaScript code in the web UI, potentially compromising session integrity and confidentiality by disclosing credentials. The CVSS 3.1 base score is 4.8, reflecting network attack vector, low attack complexity, required high privileges, user interaction needed, and partial impact on confidentiality and integrity without availability impact. No patch or vendor advisory details are currently available.

An attacker with privileged access can exploit this vulnerability to inject malicious scripts into the web interface, which may lead to unauthorized disclosure of credentials within a trusted session. This could undermine the confidentiality and integrity of user sessions but does not affect system availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict privileged user access to trusted personnel only and monitor for suspicious activity involving the web UI. Avoid executing untrusted scripts or content within the application environment.