CVE-2026-101117 PUBLISHED

IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.

Assigner: ibm
Reserved: 28.09.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 9.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	WebSphere Extreme Scale
Versions	affected from 8.6.1.0 to 8.6.2.2 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now.

ProductVersion(s)APARRemediation/First FixIBM WebSphere eXtreme Scale8.6.1.0 - 8.6.2.2PH73641

For older versions, upgrade to latest fixpack 8.6.2.2 and then apply the PH73641 iFix. If you are using 8.6.2.2 directly apply the PH73641 iFix.

Recommended Fixes page for WebSphere eXtreme Scale http://www.ibm.com/support/docview.wss

References

https://www.ibm.com/support/pages/node/7293764

Problem Types

CWE-16 Configuration CWE