{"affected":[{"product":"WebSphere Extreme Scale","source":"CNA: ibm","vendor":"IBM","versions":[{"lessThanOrEqual":"8.6.2.2","status":"affected","version":"8.6.1.0","versionType":"semver"}]}],"cveId":"CVE-2026-101117","cwes":["CWE-16"],"description":"IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.1,"severity":"critical","source":"CNA: ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},{"score":9.1,"severity":"critical","source":"NVD: psirt@us.ibm.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794154596223,"publishedAt":1794154121893,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7293764"},{"source":"psirt@us.ibm.com","tags":[],"url":"https://www.ibm.com/support/pages/node/7293764"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"IBM strongly recommends addressing the vulnerability now.\n\nProductVersion(s)APARRemediation/First FixIBM WebSphere eXtreme Scale8.6.1.0 - 8.6.2.2PH73641\n\nFor older versions, upgrade to latest fixpack 8.6.2.2 and then apply the PH73641 iFix. If you are using 8.6.2.2 directly apply the PH73641 iFix.\n\n\n\n Recommended Fixes page for WebSphere eXtreme Scale http://www.ibm.com/support/docview.wss"},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7293764"}],"revision":"85d895c037aa7db34d399fa5325e7ff74fc9691d072f36733ef2f551b188b992","sources":[{"modifiedAt":1794154121893,"name":"CNA: ibm","retrievedAt":1794157708471,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101117"},{"modifiedAt":1794154596223,"name":"NVD","retrievedAt":1794161783020,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101117"}],"ssvc":null,"status":"published","title":"IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.","updatedAt":1794161783020}