IBM WebSphere Application Server versions 8.5 and 9.0 (traditional edition) contain a flaw that enables remote attackers to inject malicious scripts into web responses viewed in clients’ browsers. The vulnerability is an instance of Cross‑Site Scripting (CWE‑79) and can result in the compromise of session data, credential theft, and defacement of web pages. The advisory title also mentions deserialization, but no explicit impact or detailed description of that aspect is provided in the CVE data, so no assumptions about code execution can be made.

The vulnerability affects IBM WebSphere Application Server traditional editions in the following version ranges: 8.5.0.0 through 8.5.5.30 and 9.0.0.0 through 9.0.5.28. Only installations running the traditional release line are impacted; other variants or later application server versions are not listed as affected.

The CVSS score of 6.1 indicates a Medium severity and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit the issue remotely over the public network by sending crafted requests that result in malicious script being returned to a victim’s browser. The client‑side nature of the exploit means that the threat primarily arises when a user interacts with the compromised web interface.