Executive brief
IBM WebSphere Application Server is a Java-based middleware platform used to host enterprise applications. A reflected cross-site scripting vulnerability allows attackers to inject malicious scripts into web pages viewed by users, potentially stealing session tokens, credentials, or sensitive data displayed on the page.
Technical details
CVE-2026-16186 is a reflected cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server versions 8.5 and 9.0. The vulnerability allows an attacker to inject malicious JavaScript code into HTTP requests that gets reflected back to victims in the application's response without proper sanitization. This attack requires user interaction—a victim must visit a malicious link or be redirected to a crafted URL. Patches are available in WebSphere Application Server 8.5.5.31 and later, and 9.0.5.29 and later.
Affected products
- IBM WebSphere Application Server 8.5, 9.0 (fixed in 8.5.5.31 and 9.0.5.29)
Timeline
- 2026-09-14: disclosed