{"id":"CVE-2026-101117","published":"2026-11-08T16:16:36.103","lastModified":"2026-11-09T17:17:05.193","description":"IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-16"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7293764","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.2.2 have an improperly configured Content Security Policy (CSP), allowing a remote attacker to bypass security restrictions without authentication. This misconfiguration could enable attackers to inject malicious content or execute unauthorized actions in the context of affected web interfaces.","exploitability":"Exploitation requires no prior access or user interaction and is straightforward for a remote attacker due to the lack of CSP enforcement.","blast_radius":"Successful exploitation could lead to unauthorized data access or manipulation via injected scripts or bypassed security controls, potentially compromising confidentiality and integrity of the WebSphere Extreme Scale environment.","remediation":"Upgrade to IBM WebSphere Extreme Scale 8.6.2.3 or later, where the improper Content Security Policy configuration has been corrected.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["csp-bypass","auth-bypass","web","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:45:14.532Z"}}