---
id: "CVE-2026-127036"
page: "https://infrastack.ai/live/CVE-2026-127036"
kind: "vulnerability"
aliases: ["CVE-2026-127036"]
title: "ibi WebFOCUS: injection flaw (vendor: reflected XSS and OS command injection; NVD: CRLF injection)"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "WebFOCUS", "fixed": [], "affected": "9.1, <= 9.2.7, <= 9.3.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["analytics", "ibi", "other", "self-hosted", "webfocus"]
not_affected_if: []
published_at: "2026-11-12T12:18:22+00:00"
first_seen_at: "2026-11-12T12:38:18+00:00"
updated_at: "2026-11-12T12:42:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127036", "first_seen_at": "2026-11-12T12:38:18+00:00"}, {"source": "analyst", "url": "https://community.tibco.com/advisories/", "first_seen_at": "2026-11-12T12:42:26+00:00", "cites": ["https://community.tibco.com/advisories/"]}]
exploit_sources: []
---

# ibi WebFOCUS: injection flaw (vendor: reflected XSS and OS command injection; NVD: CRLF injection)

Link for people: https://infrastack.ai/live/CVE-2026-127036 (this .md is for agents)

ibi's advisory of 12 Nov 2026 describes CVE-2026-127036 as a reflected XSS and OS command injection in WebFOCUS that lets an attacker inject and execute unauthorized commands. The NVD text calls it CRLF injection. The two disagree and the vendor excerpt we could read is cut off, so the vulnerable endpoint, authentication requirement and fixed versions are unknown. The CNA CVSS 4.0 vector has PR:H, meaning high privileges are required.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WebFOCUS affected 9.1, <= 9.2.7, <= 9.3.7 fixed no fixed version listed

## How to check

Check your WebFOCUS version (admin console or install directory). Affected per ibi: 9.1, 9.2.7 and below, 9.3.7 and below. Fixed versions not found: read the full ibi advisory on community.tibco.com/advisories (CVE-2026-127036) or ask ibi support.

## Timeline

- 2026-11-12T12:38:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127036
- 2026-11-12T12:42:26+00:00 analyst https://community.tibco.com/advisories/ — Vendor listing excerpt (truncated, full advisory page 403 to WebFetch) gives versions 9.1, <=9.2.7, <=9.3.7 and describes reflected XSS + OS command injection, conflicting with NVD CRLF wording. No fix versions read; nothing verified. Web/X not searched for chatter.

## Documents

- [advisory] ibi Security Advisory: November 12, 2026 - ibi WebFOCUS - CVE-2026-127036 (listing excerpt) https://community.tibco.com/advisories/

## From the sources

Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS.

This issue affects WebFOCUS: 9.1, from 9.2 through 7, and from 9.3 through 7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_