IBM Tivoli SAAM 4.1 & WebSphere App Server: XSS in Admin Console (CVE-2026-11383)
CVE-2026-11383 Published on July 30, 2026

Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-11383 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2026-11383 has been classified to as a XSS vulnerability or weakness.


Products Associated with CVE-2026-11383

Want to know whenever a new CVE is published for IBM Tivoli System Automation Application Manager? stack.watch will email you.

IBM Tivoli System Automation Application Manager
 

Affected Versions

IBM Tivoli System Automation Application Manager Version 4.1 is affected by CVE-2026-11383