CVE-2026-16186 is a reflected cross-site scripting vulnerability affecting IBM WebSphere Application Server versions 9.0 and 8.5. This vulnerability enables an attacker to inject malicious scripts that are reflected back to users, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a CVSS v3.1 base score of 5.4, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a user's browser session, potentially leading to limited disclosure of information or alteration of data. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data.