{"id":"CVE-2026-115554","kind":"vulnerability","aliases":["CVE-2026-115554"],"related":[],"title":"IBM Tivoli Netcool/OMNIbus: stored script injection in Web UI exposes sessions","description":"IBM Tivoli Netcool/OMNIbus 8.1.0 through 8.1.0.41 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","summary":"IBM Tivoli Netcool/OMNIbus 8.1.0 through 8.1.0.41 has a stored cross-site scripting flaw in its Web UI. An authenticated user can embed JavaScript that runs in other users' trusted sessions and can lead to credential disclosure.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm","netcool-omnibus","tivoli","vendor","web-ui"],"not_affected_if":["outside-affected-versions","web-ui-not-used"],"how_to_check":"- Check whether the installed Netcool/OMNIbus version is between `8.1.0` and `8.1.0.41` (the version string is unknown from the sources; check the IBM product documentation for your installation)\n- Confirm whether the Web UI is in use","fix":null,"status":"open","published_at":"2026-11-08T17:16:36+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","triaged_at":"2026-11-08T17:24:17+00:00","updated_at":"2026-11-08T17:24:17+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T17:24:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Tivoli Netcool/OMNIbus: stored script injection in Web UI exposes sessions","impact":"medium","summary":"IBM Tivoli Netcool/OMNIbus 8.1.0 through 8.1.0.41 has a stored cross-site scripting flaw in its Web UI. An authenticated user can embed JavaScript that runs in other users' trusted sessions and can lead to credential disclosure.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","netcool-omnibus","tivoli","web-ui"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in other users' sessions, leaking credentials.","analyst_note":"Find IBM's security bulletin for CVE-2026-115554 to confirm the fixed version and any workaround; the NVD entry alone does not state a fix.","how_to_check":"- Check whether the installed Netcool/OMNIbus version is between `8.1.0` and `8.1.0.41` (the version string is unknown from the sources; check the IBM product documentation for your installation)\n- Confirm whether the Web UI is in use","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-affected-versions","web-ui-not-used"],"who_is_affected":"Teams running IBM Tivoli Netcool/OMNIbus 8.1.0 through 8.1.0.41 with the Web UI enabled. The attacker needs an authenticated account on the Web UI, and the injected script runs for other users who view the stored content. Installations outside that version range, or without the Web UI, are not covered by the sources.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00078,"input_tokens":4585,"output_tokens":644,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115554':14A,17A '-2026':13A,16A '8.1.0':30B,67C '8.1.0.41':32B,69C 'allow':80C 'alter':94C 'arbitrari':86C 'authent':46B,82C 'code':88C 'credenti':62B,101C 'cross':37B,75C 'cross-sit':36B,74C 'cve':12A,15A 'disclosur':63B,102C 'emb':49B,85C 'expos':10A 'flaw':40B 'function':97C 'ibm':1A,18B,27B,64C 'inject':6A 'intend':96C 'javascript':50B,87C 'lead':60B,99C 'netcool':20B 'netcool-omnibus':19B 'netcool/omnibus':3A,29B,66C 'omnibus':21B 'potenti':98C 'run':52B 'script':5A,39B,77C 'session':11A,57B,106C 'site':38B,76C 'store':4A,35B,73C 'thus':93C 'tivoli':2A,22B,28B,65C 'trust':56B,105C 'ui':9A,26B,44B,92C 'user':47B,55B,83C 'vendor':23B 'vulner':71C,79C 'web':8A,25B,43B,91C 'web-ui':24B 'within':103C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Tivoli Netcool/OMNIbus 8.1.0 through 8.1.0.41 with the Web UI enabled. The attacker needs an authenticated account on the Web UI, and the injected script runs for other users who view the stored content. Installations outside that version range, or without the Web UI, are not covered by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibm","medium","netcoolomnibus","tivoli","vendor","webui"],"campaign_type":null,"search_a":"'-115554':14A,17A '-2026':13A,16A 'cve':12A,15A 'expos':10A 'ibm':1A 'inject':6A 'netcool/omnibus':3A 'script':5A 'session':11A 'store':4A 'tivoli':2A 'ui':9A 'web':8A","search_b":"'8.1.0':30B '8.1.0.41':32B 'authent':46B 'credenti':62B 'cross':37B 'cross-sit':36B 'disclosur':63B 'emb':49B 'flaw':40B 'ibm':18B,27B 'javascript':50B 'lead':60B 'netcool':20B 'netcool-omnibus':19B 'netcool/omnibus':29B 'omnibus':21B 'run':52B 'script':39B 'session':57B 'site':38B 'store':35B 'tivoli':22B,28B 'trust':56B 'ui':26B,44B 'user':47B,55B 'vendor':23B 'web':25B,43B 'web-ui':24B","search_c":"'8.1.0':67C '8.1.0.41':69C 'allow':80C 'alter':94C 'arbitrari':86C 'authent':82C 'code':88C 'credenti':101C 'cross':75C 'cross-sit':74C 'disclosur':102C 'emb':85C 'function':97C 'ibm':64C 'intend':96C 'javascript':87C 'lead':99C 'netcool/omnibus':66C 'potenti':98C 'script':77C 'session':106C 'site':76C 'store':73C 'thus':93C 'tivoli':65C 'trust':105C 'ui':92C 'user':83C 'vulner':71C,79C 'web':91C 'within':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T17:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115554","severity":null,"published_at":"2026-11-08T17:16:36+00:00","modified_at":"2026-11-08T17:16:36+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","fetched_at":"2026-11-08T17:22:01+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}