CVE-2026-101117 IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.

CriticalCVSS 9.1 EPSS 0.40%

Published: 2026-11-08 18:08
Updated: 2026-11-09 19:17
Exploit status: No public exploit known

Description

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.

Affected products

Product	Affected versions	Fixed in
ibm websphere extreme scale	>= 8.6.1.0, <= 8.6.2.2	No fix listed

References

www.ibm.com patch vendor-advisory

CVSS v3.1

9.1 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

All scores (2)

v3.1 9.1 · ibm
v3.1 9.1 · psirt@us.ibm.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.40% (percentile 34.7)
CWE: CWE-16 Configuration

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.