IBM WebSphere Application Server versions 9.0 and 8.5 are affected by a reflected cross-site scripting (XSS) vulnerability identified as CVE-2026-16186. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users. The CVSS score is 5.4, indicating a medium severity level. No patch or remediation details are provided in the available data.