{"id":"CVE-2026-101117","kind":"vulnerability","aliases":["CVE-2026-101117"],"related":[],"title":"IBM WebSphere Extreme Scale: remote attacker bypasses security restrictions via CSP","description":"IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.","summary":"IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.2.2 have an improper Content Security Policy configuration. A remote attacker can bypass security restrictions because of it.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM WebSphere Extreme Scale","fixed":["8.6.2.2 + iFix PH73641"],"affected":">= 8.6.1.0, <= 8.6.2.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm","infrastructure","java","liberty","self-hosted","websphere-extreme-scale"],"not_affected_if":["unknown"],"how_to_check":"Check your WebSphere eXtreme Scale version: 8.6.1.0 through 8.6.2.2 is affected. IBM's bulletin is titled for the Liberty deployment, so check Liberty deployments first. Then confirm iFix PH73641 is installed (see IBM's Recommended Fixes page for WebSphere eXtreme Scale).","fix":"Upgrade to fixpack 8.6.2.2, then apply iFix PH73641 (if already on 8.6.2.2, apply PH73641 directly). IBM lists no workaround.","status":"open","published_at":"2026-11-08T16:16:36+00:00","first_seen_at":"2026-11-08T16:18:33+00:00","triaged_at":"2026-11-08T16:18:50+00:00","updated_at":"2026-11-08T16:19:45+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-08T16:18:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM WebSphere Extreme Scale: remote attacker bypasses security restrictions via CSP","impact":"medium","summary":"IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.2.2 have an improper Content Security Policy configuration. A remote attacker can bypass security restrictions because of it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["websphere-extreme-scale","ibm","java"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker bypasses security restrictions on the server","analyst_note":"Check the IBM security bulletin for CVE-2026-101117 for the fixed version and the exact CSP misconfiguration; the NVD entry alone gives no fix or setting.","how_to_check":"- Check the installed WebSphere Extreme Scale version against the affected range `8.6.1.0` through `8.6.2.2`\n- unknown for other checks: the sources do not say which configuration to inspect","plain_action":"","product_name":"IBM WebSphere Extreme Scale","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM WebSphere Extreme Scale in the affected range 8.6.1.0 through 8.6.2.2 are exposed. The sources do not describe which deployment or configuration makes it reachable, so unknown whether a default install is affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000745,"input_tokens":4536,"output_tokens":582,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for CVE-2026-101117 for the fixed version and the exact CSP misconfiguration; the NVD entry alone gives no fix or setting.","search":"'-101117':14A,17A '-2026':13A,16A '8.6.1.0':38B,59C '8.6.2.2':40B,61C 'allow':63C 'attack':6A,50B,66C 'bypass':7A,52B,68C 'configur':47B,77C 'content':44B,74C 'could':62C 'csp':11A 'cve':12A,15A 'due':71C 'extrem':3A,31B,35B,57C 'extreme':20A 'host':28B 'ibm':1A,18A,22B,33B,55C 'improp':43B,73C 'infrastructur':23B 'java':24B 'liberti':25B 'polici':46B,76C 'remot':5A,49B,65C 'restrict':9A,54B,70C 'scale':4A,21A,32B,36B,58C 'secur':8A,45B,53B,69C,75C 'self':27B 'self-host':26B 'version':37B 'via':10A 'webspher':2A,30B,34B,56C 'websphere':19A 'websphere-extreme-scal':29B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM WebSphere eXtreme Scale 8.6.1.0 through 8.6.2.2 are affected. IBM's bulletin is titled for the Liberty deployment and does not say how other deployments are affected, so check any installation. The flaw is an improper Content Security Policy configuration that lets a remote attacker bypass security restrictions, without login (CVSS 9.1). Teams not running eXtreme Scale can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-08T16:19:45Z","by":"analyst","doc":"https://www.ibm.com/support/pages/recommended-fixes-websphere-extreme-scale","run_id":2189},"products":{"at":"2026-11-08T16:19:45Z","by":"analyst","doc":"https://www.ibm.com/support/pages/recommended-fixes-websphere-extreme-scale","run_id":2189},"workarounds":{"at":"2026-11-08T16:19:45Z","by":"analyst","doc":"https://www.ibm.com/support/pages/recommended-fixes-websphere-extreme-scale","run_id":2189},"how_to_check":{"at":"2026-11-08T16:19:45Z","by":"analyst","doc":"https://www.ibm.com/support/pages/recommended-fixes-websphere-extreme-scale","run_id":2189},"who_affected":{"at":"2026-11-08T16:19:45Z","by":"analyst","doc":"https://www.ibm.com/support/pages/recommended-fixes-websphere-extreme-scale","run_id":2189}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmwebsphereextremescale","websphereextremescale"],"ptokens":["extreme","ibm","scale","websphere"],"labels":["critical","ibm","infrastructure","java","liberty","selfhosted","vendor","websphereextremescale"],"campaign_type":null,"search_a":"'-101117':14A,17A '-2026':13A,16A 'attack':6A 'bypass':7A 'csp':11A 'cve':12A,15A 'extrem':3A 'extreme':20A 'ibm':1A,18A 'remot':5A 'restrict':9A 'scale':4A,21A 'secur':8A 'via':10A 'webspher':2A 'websphere':19A","search_b":"'8.6.1.0':38B '8.6.2.2':40B 'attack':50B 'bypass':52B 'configur':47B 'content':44B 'extrem':31B,35B 'host':28B 'ibm':22B,33B 'improp':43B 'infrastructur':23B 'java':24B 'liberti':25B 'polici':46B 'remot':49B 'restrict':54B 'scale':32B,36B 'secur':45B,53B 'self':27B 'self-host':26B 'version':37B 'webspher':30B,34B 'websphere-extreme-scal':29B","search_c":"'8.6.1.0':59C '8.6.2.2':61C 'allow':63C 'attack':66C 'bypass':68C 'configur':77C 'content':74C 'could':62C 'due':71C 'extrem':57C 'ibm':55C 'improp':73C 'polici':76C 'remot':65C 'restrict':70C 'scale':58C 'secur':69C,75C 'webspher':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T16:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101117","severity":null,"published_at":"2026-11-08T16:16:36+00:00","modified_at":"2026-11-08T16:16:36+00:00","first_seen_at":"2026-11-08T16:18:33+00:00","fetched_at":"2026-11-08T16:18:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101117:2189","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-websphere-extremes-scale-liberty-deployment-affected-cross-site-scriptingxss-attacks","severity":null,"published_at":"2026-11-08T16:19:45+00:00","modified_at":"2026-11-08T16:19:45+00:00","first_seen_at":"2026-11-08T16:19:45+00:00","fetched_at":"2026-11-08T16:19:45+00:00","note":"Read IBM bulletin (published 23 Oct 2026): WXS 8.6.1.0-8.6.2.2 affected, fix is APAR PH73641 iFix on top of fixpack 8.6.2.2; no workarounds. Bulletin is titled for the Liberty deployment; it does not say whether other deployments are affected. No exploitation or PoC found; no social search done.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-websphere-extremes-scale-liberty-deployment-affected-cross-site-scriptingxss-attacks","https://www.ibm.com/support/pages/recommended-fixes-websphere-extreme-scale"]}],"documents":[{"id":102480,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-websphere-extremes-scale-liberty-deployment-affected-cross-site-scriptingxss-attacks","title":"IBM Security Bulletin: WebSphere eXtremes Scale Liberty deployment XSS (CVE-2026-101117)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":102481,"url":"https://www.ibm.com/support/pages/recommended-fixes-websphere-extreme-scale","title":"Recommended fixes for WebSphere eXtreme Scale","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}