The Wildfly HAL Console contains a cross-site scripting vulnerability (CWE-79) due to improper or missing neutralization of user-controlled input before it is rendered in web pages served to other users. An attacker must be authenticated with elevated management privileges (SuperUser, Admin, or Maintainer) to exploit this flaw. Successful exploitation could lead to the execution of arbitrary scripts in the context of the affected web application, impacting confidentiality and integrity. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. Multiple Red Hat security advisories (RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, RHSA-2025:10931) provide patches for this vulnerability.

An attacker with authenticated access and elevated management privileges can exploit this vulnerability to execute arbitrary scripts in the context of the HAL Console web interface. This can lead to unauthorized disclosure and modification of sensitive information within the management console. There is no impact on system availability. No known exploits are reported in the wild at this time.

Official patches are available from Red Hat as referenced in advisories RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, and RHSA-2025:10931. Applying these updates will remediate the vulnerability. Since the vulnerability requires authenticated access with high privileges, restricting access to trusted users and promptly applying the vendor patches are the primary mitigations.