Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

IBM WebSphere Extreme Scale can let attackers run scripts

CVE-2026-101117 · published today
Summary

Versions 8.6.1.0 through 8.6.2.2 of IBM WebSphere Extreme Scale may let a remote user bypass security settings because the content‑security rules are not set correctly. This could allow malicious code to be injected into web pages viewed by users. Apply the latest security update from IBM or reconfigure the content‑security policy to block unwanted scripts.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm websphere extreme scale <= 8.6.2.2
Original advisory text
IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Type
CWE-16Configuration
Timeline
Published8 Nov 2026
Updated8 Nov 2026
First seen8 Nov 2026
Sources
CVE-2026-101117 · NVD
CVE-2026-101117 · MITRE
Track software like this
Free during beta