{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101117", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-09-28T06:27:45.163Z", "datePublished": "2026-11-08T16:08:41.893Z", "dateUpdated": "2026-11-08T16:08:41.893Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T16:08:41.893Z"}, "title": "IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-16", "description": "CWE-16 Configuration", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "WebSphere Extreme Scale", "versions": [{"status": "affected", "version": "8.6.1.0", "lessThanOrEqual": "8.6.2.2", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_extreme_scale:8.6.2.2:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7293764", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\nProductVersion(s)APARRemediation/First FixIBM WebSphere eXtreme Scale8.6.1.0 - 8.6.2.2PH73641\n\nFor older versions, upgrade to latest fixpack 8.6.2.2 and then apply the PH73641 iFix. If you are using 8.6.2.2 directly apply the PH73641 iFix.\n\n\n\n Recommended Fixes page for WebSphere eXtreme Scale http://www.ibm.com/support/docview.wss", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly recommends addressing the vulnerability now.</p><div><table><tbody><tr><td>Product</td><td>Version(s)</td><td>APAR</td><td>Remediation/First Fix</td></tr><tr><td>IBM WebSphere eXtreme Scale</td><td>8.6.1.0 - 8.6.2.2</td><td>PH73641</td><td><p>For older versions, upgrade to latest fixpack 8.6.2.2 and then apply the PH73641 iFix. If you are using 8.6.2.2 directly apply the PH73641 iFix.</p><p><a href=\"http://www.ibm.com/support/docview.wss?uid=swg27018991\" rel=\"nofollow\">Recommended Fixes page for WebSphere eXtreme Scale</a></p></td></tr></tbody></table></div>"}]}]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_extreme_scale:8.6.2.2:*:*:*:*:*:*:*"], "product": "WebSphere Extreme Scale", "vendor": "IBM", "versions": [{"lessThanOrEqual": "8.6.2.2", "status": "affected", "version": "8.6.1.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration."}], "id": "CVE-2026-101117", "lastModified": "2026-11-08T16:16:36.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "psirt@us.ibm.com", "type": "Primary"}]}, "published": "2026-11-08T16:16:36.103", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7293764"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-16"}], "source": "psirt@us.ibm.com", "type": "Primary"}]}

{}

{}