CVE-2026-101117

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101117", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-09-28T06:27:45.163Z", "datePublished": "2026-11-08T16:08:41.893Z", "dateUpdated": "2026-11-09T16:59:40.206Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T16:08:41.893Z"}, "title": "IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-16", "description": "CWE-16 Configuration", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "WebSphere Extreme Scale", "versions": [{"status": "affected", "version": "8.6.1.0", "lessThanOrEqual": "8.6.2.2", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_extreme_scale:8.6.2.2:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7293764", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\nProductVersion(s)APARRemediation/First FixIBM WebSphere eXtreme Scale8.6.1.0 - 8.6.2.2PH73641\n\nFor older versions, upgrade to latest fixpack 8.6.2.2 and then apply the PH73641 iFix. If you are using 8.6.2.2 directly apply the PH73641 iFix.\n\n\n\n Recommended Fixes page for WebSphere eXtreme Scale http://www.ibm.com/support/docview.wss", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly recommends addressing the vulnerability now.</p><div><table><tbody><tr><td>Product</td><td>Version(s)</td><td>APAR</td><td>Remediation/First Fix</td></tr><tr><td>IBM WebSphere eXtreme Scale</td><td>8.6.1.0 - 8.6.2.2</td><td>PH73641</td><td><p>For older versions, upgrade to latest fixpack 8.6.2.2 and then apply the PH73641 iFix. If you are using 8.6.2.2 directly apply the PH73641 iFix.</p><p><a href=\"http://www.ibm.com/support/docview.wss?uid=swg27018991\" rel=\"nofollow\">Recommended Fixes page for WebSphere eXtreme Scale</a></p></td></tr></tbody></table></div>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:59:29.038352Z", "id": "CVE-2026-101117", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:59:40.206Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-101117", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-09T16:59:29.038352Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:59:35.321Z"}}], "cna": {"title": "IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_extreme_scale:8.6.2.2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "WebSphere Extreme Scale", "versions": [{"status": "affected", "version": "8.6.1.0", "versionType": "semver", "lessThanOrEqual": "8.6.2.2"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\nProductVersion(s)APARRemediation/First FixIBM WebSphere eXtreme Scale8.6.1.0 - 8.6.2.2PH73641\n\nFor older versions, upgrade to latest fixpack 8.6.2.2 and then apply the PH73641 iFix. If you are using 8.6.2.2 directly apply the PH73641 iFix.\n\n\n\n Recommended Fixes page for WebSphere eXtreme Scale http://www.ibm.com/support/docview.wss", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability now.</p><div><table><tbody><tr><td>Product</td><td>Version(s)</td><td>APAR</td><td>Remediation/First Fix</td></tr><tr><td>IBM WebSphere eXtreme Scale</td><td>8.6.1.0 - 8.6.2.2</td><td>PH73641</td><td><p>For older versions, upgrade to latest fixpack 8.6.2.2 and then apply the PH73641 iFix. If you are using 8.6.2.2 directly apply the PH73641 iFix.</p><p><a href=\"http://www.ibm.com/support/docview.wss?uid=swg27018991\" rel=\"nofollow\">Recommended Fixes page for WebSphere eXtreme Scale</a></p></td></tr></tbody></table></div>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7293764", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-16", "description": "CWE-16 Configuration"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T16:08:41.893Z"}}}, "cveMetadata": {"cveId": "CVE-2026-101117", "state": "PUBLISHED", "dateUpdated": "2026-11-09T16:59:40.206Z", "dateReserved": "2026-09-28T06:27:45.163Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-11-08T16:08:41.893Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_extreme_scale:8.6.2.2:*:*:*:*:*:*:*"], "product": "WebSphere Extreme Scale", "vendor": "IBM", "versions": [{"lessThanOrEqual": "8.6.2.2", "status": "affected", "version": "8.6.1.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration."}], "id": "CVE-2026-101117", "lastModified": "2026-11-09T17:17:05.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101117", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:59:29.038352Z", "version": "2.0.3"}}]}, "published": "2026-11-08T16:16:36.103", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7293764"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-16"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.6.1.0,8.6.2.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WebSphere Extreme Scale", "source": "cna", "vendor": "IBM"}, "product": "websphere_extreme_scale", "vendor": "ibm"}], "created": "2026-11-08T17:45:07.838756+00:00", "updated": "2026-11-08T18:00:16.762282+00:00", "vendors": ["ibm", "ibm$PRODUCT$websphere_extreme_scale"]}