CVE-2026-11538

IBM WebSphere Application Server versions 9.0 and 8.5 are vulnerable to a log injection attack via specially crafted LTPA token cookies, which could allow an attacker to manipulate log files and potentially disclose sensitive information. While the severity is rated low, organizations using these versions should prioritize remediation to mitigate any risk of information leakage and maintain the integrity of their logging mechanisms. This is particularly relevant for security teams and system administrators managing WebSphere environments.