---
id: "CVE-2026-101117"
page: "https://infrastack.ai/live/CVE-2026-101117"
kind: "vulnerability"
aliases: ["CVE-2026-101117"]
title: "IBM WebSphere Extreme Scale: remote attacker bypasses security restrictions via CSP"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "IBM WebSphere Extreme Scale", "fixed": ["8.6.2.2 + iFix PH73641"], "affected": ">= 8.6.1.0, <= 8.6.2.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ibm", "infrastructure", "java", "liberty", "self-hosted", "websphere-extreme-scale"]
not_affected_if: ["unknown"]
published_at: "2026-11-08T16:16:36+00:00"
first_seen_at: "2026-11-08T16:18:33+00:00"
updated_at: "2026-11-08T16:19:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101117", "first_seen_at": "2026-11-08T16:18:33+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-websphere-extremes-scale-liberty-deployment-affected-cross-site-scriptingxss-attacks", "first_seen_at": "2026-11-08T16:19:45+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-websphere-extremes-scale-liberty-deployment-affected-cross-site-scriptingxss-attacks", "https://www.ibm.com/support/pages/recommended-fixes-websphere-extreme-scale"]}]
exploit_sources: []
---

# IBM WebSphere Extreme Scale: remote attacker bypasses security restrictions via CSP

Link for people: https://infrastack.ai/live/CVE-2026-101117 (this .md is for agents)

IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.2.2 have an improper Content Security Policy configuration. A remote attacker can bypass security restrictions because of it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM WebSphere Extreme Scale affected >= 8.6.1.0, <= 8.6.2.2 fixed 8.6.2.2 + iFix PH73641

## How to check

Check your WebSphere eXtreme Scale version: 8.6.1.0 through 8.6.2.2 is affected. IBM's bulletin is titled for the Liberty deployment, so check Liberty deployments first. Then confirm iFix PH73641 is installed (see IBM's Recommended Fixes page for WebSphere eXtreme Scale).

## Fix

Upgrade to fixpack 8.6.2.2, then apply iFix PH73641 (if already on 8.6.2.2, apply PH73641 directly). IBM lists no workaround.

## Timeline

- 2026-11-08T16:18:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101117
- 2026-11-08T16:19:45+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-websphere-extremes-scale-liberty-deployment-affected-cross-site-scriptingxss-attacks — Read IBM bulletin (published 23 Oct 2026): WXS 8.6.1.0-8.6.2.2 affected, fix is APAR PH73641 iFix on top of fixpack 8.6.2.2; no workarounds. Bulletin is titled for the Liberty deployment; it does not say whether other deployments are affected. No exploitation or PoC found; no social search done.

## Documents

- [advisory] IBM Security Bulletin: WebSphere eXtremes Scale Liberty deployment XSS (CVE-2026-101117) https://www.ibm.com/support/pages/security-bulletin-ibm-websphere-extremes-scale-liberty-deployment-affected-cross-site-scriptingxss-attacks
- [fix] Recommended fixes for WebSphere eXtreme Scale https://www.ibm.com/support/pages/recommended-fixes-websphere-extreme-scale

## From the sources

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_