IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.

IBM WebSphere Application Server versions 9.0 and 8.5 are affected by a cross-site scripting (XSS) vulnerability located in the administrative console's integrated help system. This vulnerability could allow attackers to inject malicious scripts into the help interface, potentially affecting administrators or users accessing the console. The vulnerability is tracked under CVE-2026-11708 and has been published by NVD. IBM has issued a support advisory providing remediation guidance. The affected versions represent widely deployed enterprise application server software, making this a notable security concern for organizations running these versions.