CVE-2026-11383: Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager
Published Jul 24, 2026
·Updated
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.
Affected Software
19 affected components
IBM Tivoli System Automation Application Manager<=4.1
All of the following
IBM WebSphere Application Server>=8.5<8.5.5.30
Any of the following
IBM AIX
IBM i
IBM Z\/os
Linux Linux kernel
Microsoft Windows
All of the following
IBM WebSphere Application Server>=9.0<9.0.5.29
Any of the following
IBM AIX
IBM i
IBM Z\/os
Linux Linux kernel
Microsoft Windows
All of the following
IBM Tivoli System Automation Application Manager>=4.1.0<=4.1.0.7
Any of the following
IBM AIX
IBM i
IBM Z\/os
Linux Linux kernel
Microsoft Windows
Event History
Jul 24, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Jul 30, 2026
CVE Published
via MITRE·02:12 PM
Data Sourced
via MITRE·02:12 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-11383?
CVE-2026-11383 has a risk rating of 31, indicating a high level of severity due to its potential impact.
2
What type of vulnerability is CVE-2026-11383?
CVE-2026-11383 is classified as a cross-site scripting (XSS) vulnerability affecting the IBM WebSphere Application Server.
3
How do I fix CVE-2026-11383?
To fix CVE-2026-11383, apply the patch or update provided by IBM for the affected version of the WebSphere Application Server.
4
Which software is affected by CVE-2026-11383?
CVE-2026-11383 affects IBM WebSphere Application Server specifically in its Administrative Console.
5
When was CVE-2026-11383 published?
CVE-2026-11383 was published on June 23, 2026.