{"id":"CVE-2026-127036","kind":"vulnerability","aliases":["CVE-2026-127036"],"related":[],"title":"ibi WebFOCUS: injection flaw (vendor: reflected XSS and OS command injection; NVD: CRLF injection)","description":"Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS.\n\nThis issue affects WebFOCUS: 9.1, from 9.2 through 7, and from 9.3 through 7.","summary":"ibi's advisory of 12 Nov 2026 describes CVE-2026-127036 as a reflected XSS and OS command injection in WebFOCUS that lets an attacker inject and execute unauthorized commands. The NVD text calls it CRLF injection. The two disagree and the vendor excerpt we could read is cut off, so the vulnerable endpoint, authentication requirement and fixed versions are unknown. The CNA CVSS 4.0 vector has PR:H, meaning high privileges are required.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WebFOCUS","fixed":[],"affected":"9.1, <= 9.2.7, <= 9.3.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["analytics","ibi","other","self-hosted","webfocus"],"not_affected_if":[],"how_to_check":"Check your WebFOCUS version (admin console or install directory). Affected per ibi: 9.1, 9.2.7 and below, 9.3.7 and below. Fixed versions not found: read the full ibi advisory on community.tibco.com/advisories (CVE-2026-127036) or ask ibi support.","fix":null,"status":"open","published_at":"2026-11-12T12:18:22+00:00","first_seen_at":"2026-11-12T12:38:18+00:00","triaged_at":"2026-11-12T12:40:31+00:00","updated_at":"2026-11-12T12:42:26+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-12T12:40:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"ibi WebFOCUS: CRLF injection flaw lets attackers tamper with HTTP responses","impact":"medium","summary":"WebFOCUS, a business analytics platform from ibi, does not neutralize CRLF sequences in some input, which is the classic CRLF injection flaw. An attacker who can send crafted input can inject HTTP headers or split responses, which can be used for cache poisoning, session tricks or cross-site scripting.","audience":"businesses","category":"other","nicknames":[],"who_cares":["webfocus","ibi","analytics"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker injects HTTP headers or splits responses on the server","analyst_note":"Check the NVD entry and the ibi advisory for the affected endpoint, the fixed WebFOCUS versions and whether authentication is required.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"WebFOCUS installs in the listed version ranges are the exposed systems; the description does not say which input field or endpoint is involved, or whether authentication is needed. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":4536,"output_tokens":464,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the ibi advisory for the affected endpoint, the fixed WebFOCUS versions and whether authentication is required.","search":"'-127036':17A,20A,39B '-2026':16A,19A,38B '12':33B '2026':35B '4.0':93B '7':122C,127C '9.1':118C '9.2':120C '9.3':125C 'advisori':31B 'affect':116C 'analyt':22B 'attack':53B 'authent':83B 'call':62B 'cna':91B 'command':10A,46B,58B 'could':74B 'crlf':13A,64B,106C,108C 'cut':77B 'cve':15A,18A,37B 'cvss':92B 'describ':36B 'disagre':68B 'endpoint':82B 'excerpt':72B 'execut':56B 'fix':86B 'flaw':4A 'h':97B 'high':99B 'host':27B 'ibi':1A,23B,29B,112C 'improp':103C 'inject':3A,11A,14A,47B,54B,65B,109C 'issu':115C 'let':51B 'mean':98B 'neutral':104C 'nov':34B 'nvd':12A,60B 'os':9A,45B 'pr':96B 'privileg':100B 'read':75B 'reflect':6A,42B 'requir':84B,102B 'self':26B 'self-host':25B 'sequenc':107C 'text':61B 'two':67B 'unauthor':57B 'unknown':89B 'vector':94B 'vendor':5A,71B 'version':87B 'vulner':81B,110C 'webfocus':2A,21A,28B,49B,113C,117C 'xss':7A,43B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted ibi WebFOCUS installs on 9.1, 9.2.7 or earlier, or 9.3.7 or earlier. The CNA vector requires high privileges (PR:H), so an attacker likely needs an authenticated admin-level account, but the vendor excerpt does not say so. Teams not running WebFOCUS can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["webfocus"],"ptokens":["webfocus"],"labels":["analytics","high","ibi","other","selfhosted","webfocus"],"campaign_type":null,"search_a":"'-127036':17A,20A '-2026':16A,19A 'command':10A 'crlf':13A 'cve':15A,18A 'flaw':4A 'ibi':1A 'inject':3A,11A,14A 'nvd':12A 'os':9A 'reflect':6A 'vendor':5A 'webfocus':2A,21A 'xss':7A","search_b":"'-127036':39B '-2026':38B '12':33B '2026':35B '4.0':93B 'advisori':31B 'analyt':22B 'attack':53B 'authent':83B 'call':62B 'cna':91B 'command':46B,58B 'could':74B 'crlf':64B 'cut':77B 'cve':37B 'cvss':92B 'describ':36B 'disagre':68B 'endpoint':82B 'excerpt':72B 'execut':56B 'fix':86B 'h':97B 'high':99B 'host':27B 'ibi':23B,29B 'inject':47B,54B,65B 'let':51B 'mean':98B 'nov':34B 'nvd':60B 'os':45B 'pr':96B 'privileg':100B 'read':75B 'reflect':42B 'requir':84B,102B 'self':26B 'self-host':25B 'text':61B 'two':67B 'unauthor':57B 'unknown':89B 'vector':94B 'vendor':71B 'version':87B 'vulner':81B 'webfocus':28B,49B 'xss':43B","search_c":"'7':122C,127C '9.1':118C '9.2':120C '9.3':125C 'affect':116C 'crlf':106C,108C 'ibi':112C 'improp':103C 'inject':109C 'issu':115C 'neutral':104C 'sequenc':107C 'vulner':110C 'webfocus':113C,117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T12:18:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@tibco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127036","severity":null,"published_at":"2026-11-12T12:18:22+00:00","modified_at":"2026-11-12T12:18:22+00:00","first_seen_at":"2026-11-12T12:38:18+00:00","fetched_at":"2026-11-12T12:38:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127036:3733","url":"https://community.tibco.com/advisories/","severity":null,"published_at":"2026-11-12T12:42:26+00:00","modified_at":"2026-11-12T12:42:26+00:00","first_seen_at":"2026-11-12T12:42:26+00:00","fetched_at":"2026-11-12T12:42:26+00:00","note":"Vendor listing excerpt (truncated, full advisory page 403 to WebFetch) gives versions 9.1, <=9.2.7, <=9.3.7 and describes reflected XSS + OS command injection, conflicting with NVD CRLF wording. No fix versions read; nothing verified. Web/X not searched for chatter.","cites":["https://community.tibco.com/advisories/"]}],"documents":[{"id":134880,"url":"https://community.tibco.com/advisories/","title":"ibi Security Advisory: November 12, 2026 - ibi WebFOCUS - CVE-2026-127036 (listing excerpt)","kind":"advisory","source":"analyst","publisher":null,"text":"ibi Security Advisory: November 12, 2026 - ibi WebFocus - CVE-2026-127036 (Cloud Software Group Security, TIBCO Community listing excerpt)\nibi WebFOCUS - Reflected XSS & OS Command Injection Vulnerability. Original release date: November 12, 2026. Source: ibi. Product(s) Affected (Affected Versions): ibi WebFOCUS 9.1, 9.2.7 & below, 9.3.7 & below. Description: ibi WebFOCUS contains an injection vulnerability that allows an attacker to inject and execute unauthorized commands. Impact: A successful exploit of this vulnerability could lead to the disclosure of sensitive information and unauthori[zed ...] (excerpt truncated in listing).\n","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}