{"affected":[{"defaultStatus":"affected","product":"WebFOCUS","source":"CNA: tibco","vendor":"ibi","versions":[{"status":"affected","version":"9.1","versionType":"Patch"},{"lessThanOrEqual":"7","status":"affected","version":"9.2","versionType":"Patch"},{"lessThanOrEqual":"7","status":"affected","version":"9.3","versionType":"Hotfix"}]}],"cveId":"CVE-2026-127036","cwes":["CWE-93"],"description":"Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS.\n\nThis issue affects WebFOCUS: 9.1, from 9.2 through 7, and from 9.3 through 7.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: tibco","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L","version":"4.0"}],"modifiedAt":1794485395650,"publishedAt":1794483256443,"references":[{"source":"CNA: tibco","tags":[],"url":"https://community.tibco.com/advisories/ibi-security-advisory-november-12-2026-ibi-webfocus-cve-2026-127036-r230/"}],"remediation":[],"revision":"ddb6132e436553ecc2e7aac0c0e045368b9ada7a20c13d4fb23c8d952cdc3662","sources":[{"modifiedAt":1794485395650,"name":"CNA: tibco","retrievedAt":1794488941928,"url":"https://www.cve.org/CVERecord?id=CVE-2026-127036"}],"ssvc":null,"status":"published","title":"ibi WebFOCUS - OS Command Injection Vulnerability","updatedAt":1794488941928}