CVE-2026-16186NVD

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability.

Severity Level

MEDIUM(5.4)

Published Date

Sep 14, 2026

Last Modified

Sep 15, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

0.18%Probability

Root Weakness (CWE)

The software does not neutralize user-controllable input before it is placed in output that is used as a web page.

CVSS v3.1 Base Metrics — Score 5.4 (MEDIUM)

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionRequired

ScopeUnchanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

Affected Versions

Patched Versions

Not provided by cveorg for this CVE.

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.