IBM WEBSPHERE EXTREME SCALE · CVE-2026-101117 · Infrastructure
FIX → 8.6.2.2 + iFix PH73641 ✓ verified
IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.2.2 have an improper Content Security Policy configuration. A remote attacker can bypass security restrictions because of it.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running IBM WebSphere eXtreme Scale 8.6.1.0 through 8.6.2.2 are affected. IBM's bulletin is titled for the Liberty deployment and does not say how other deployments are affected, so check any installation. The flaw is an improper Content Security Policy configuration that lets a remote attacker bypass security restrictions, without login (CVSS 9.1). Teams not running eXtreme Scale can skip it.
Not affected if unknown
Who cares ibm, java, liberty, self-hosted, websphere-extreme-scale
8.6.1.0 through 8.6.2.2 is affectedIBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.6.2.2 + iFix PH73641
8.6.2.2, then apply iFix PH73641 (if already on 8.6.2.2, apply PH73641 directly)