IBM WebSphere Extreme Scale CSP misconfiguration allows XSS and security bypass (CVE-2026-101117)

What happened

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 is affected by an improper Content Security Policy configuration, which the CVE record classifies as CWE-16. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, giving a base score of 9.1. In practical terms, a remote attacker can reach the affected component over the network, needs no credentials, and does not require any user interaction. A successful exploit compromises confidentiality and integrity, but not availability.

IBM's CVE title describes the issue as cross-site scripting (XSS), which indicates that the misconfigured Content Security Policy can allow an attacker to bypass the browser restrictions that would normally contain script execution. The CVE record's description frames the impact more broadly as a security restriction bypass. There is no statement in the CVE record that the flaw has been publicly disclosed or exploited, and CISA's Known Exploited Vulnerabilities catalogue does not list this CVE.

Who is affected

IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.2.2 are affected. The CVE record does not list any other affected products or versions, so if you run an instance in this range, treat it as vulnerable until you can confirm otherwise with IBM.

What to do now

1. Confirm whether any WebSphere Extreme Scale deployment in your estate is running a version from 8.6.1.0 through 8.6.2.2.
2. Open IBM's support page for this CVE to identify the corrected release. The CVE record indicates that a fix is available but does not list the specific fixed version, so treat the IBM bulletin as authoritative.
3. Apply IBM's fix. The CVSS score is 9.1 Critical; schedule the change with that urgency.
4. If you cannot patch immediately, restrict network access to affected instances to trusted hosts only, and monitor for unexpected administrative or content changes. No workaround or mitigation has been published in the CVE record.

Beyond the patch

Because this weakness can be reached over the network without credentials, the first question is whether your WebSphere Extreme Scale instances are exposed to anything other than trusted systems. Virtual CISO Services helps you find that exposure and close it. On the supply side, your patch window depends on IBM's release cycle and your own visibility into which vendors' software you run; Supply Chain Defense & Third-Party Risk tracks those dependencies so your exposure is measured rather than assumed.