{"api_version":"1","generated_at":"2026-11-08T17:01:11+00:00","cve":"CVE-2026-101117","urls":{"html":"https://cve.report/CVE-2026-101117","api":"https://cve.report/api/cve/CVE-2026-101117.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-101117","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-101117"},"summary":{"title":"IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.","description":"IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-11-08 16:16:36","updated_at":"2026-11-08 16:16:36"},"problem_types":["CWE-16","CWE-16 CWE-16 Configuration"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Primary","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293764","name":"https://www.ibm.com/support/pages/node/7293764","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101117","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101117","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"WebSphere Extreme Scale","version":"affected 8.6.1.0 8.6.2.2 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"IBM strongly recommends addressing the vulnerability now.\n\nProductVersion(s)APARRemediation/First FixIBM WebSphere eXtreme Scale8.6.1.0 - 8.6.2.2PH73641\n\nFor older versions, upgrade to latest fixpack 8.6.2.2 and then apply the PH73641 iFix. If you are using 8.6.2.2 directly apply the PH73641 iFix.\n\n\n\n Recommended Fixes page for WebSphere eXtreme Scale http://www.ibm.com/support/docview.wss","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:websphere_extreme_scale:8.6.2.2:*:*:*:*:*:*:*"],"product":"WebSphere Extreme Scale","vendor":"IBM","versions":[{"lessThanOrEqual":"8.6.2.2","status":"affected","version":"8.6.1.0","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.</p>"}],"value":"IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-16","description":"CWE-16 Configuration","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-08T16:08:41.893Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7293764"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM strongly recommends addressing the vulnerability now.</p><div><table><tbody><tr><td>Product</td><td>Version(s)</td><td>APAR</td><td>Remediation/First Fix</td></tr><tr><td>IBM WebSphere eXtreme Scale</td><td>8.6.1.0 - 8.6.2.2</td><td>PH73641</td><td><p>For older versions, upgrade to latest fixpack 8.6.2.2 and then apply the PH73641 iFix. If you are using 8.6.2.2 directly apply the PH73641 iFix.</p><p><a href=\"http://www.ibm.com/support/docview.wss?uid=swg27018991\" rel=\"nofollow\">Recommended Fixes page for WebSphere eXtreme Scale</a></p></td></tr></tbody></table></div>"}],"value":"IBM strongly recommends addressing the vulnerability now.\n\nProductVersion(s)APARRemediation/First FixIBM WebSphere eXtreme Scale8.6.1.0 - 8.6.2.2PH73641\n\nFor older versions, upgrade to latest fixpack 8.6.2.2 and then apply the PH73641 iFix. If you are using 8.6.2.2 directly apply the PH73641 iFix.\n\n\n\n Recommended Fixes page for WebSphere eXtreme Scale http://www.ibm.com/support/docview.wss"}],"title":"IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks."}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-101117","datePublished":"2026-11-08T16:08:41.893Z","dateReserved":"2026-09-28T06:27:45.163Z","dateUpdated":"2026-11-08T16:08:41.893Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-08 16:16:36","lastModifiedDate":"2026-11-08 16:16:36","problem_types":["CWE-16","CWE-16 CWE-16 Configuration"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"101117","Ordinal":"1","Title":"IBM WebSphere eXtremes Scale Liberty deployment is affected by C","CVE":"CVE-2026-101117","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"101117","Ordinal":"1","NoteData":"IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.","Type":"Description","Title":"IBM WebSphere eXtremes Scale Liberty deployment is affected by C"}]}}}