Advisory · CVE-2026-101117
IBM WebSphere Extreme Scale can be tricked past its content security policy
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration, rated critical at CVSS 9.1.
- Vendor
- IBM
- Product
- WebSphere Extreme Scale
- Identifier / CWE
- CVE-2026-101117
CWE-16 - Action timing
- Immediate
Explain it like I’m five
A content security policy is a list telling the browser what a page is allowed to load. WebSphere Extreme Scale ships one with a hole in it, so an attacker can get the browser to run or load things the policy was supposed to block.
- 01Targeted deployment
An attacker finds a WebSphere Extreme Scale deployment.
- 02Policy gap found
The improper Content Security Policy configuration is identified.
- 03Restriction bypassed
The attacker crafts content the policy should have blocked.
- 04Browser runs it
The victim browser loads or executes the disallowed content.
What happened
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration. The record rates it critical at CVSS 9.1 under version 3.1, with network attack vector, low complexity, no privileges required, and no user interaction.
IBM’s bulletin lists the affected versions and the fix. A misconfigured content security policy undermines the browser-side protections the deployment relies on.
What to do
- Inventory WebSphere Extreme Scale deployments and record each version.
- Check the IBM bulletin for the fix and apply it.
- Review the Content Security Policy configuration on affected deployments.
- Monitor for content injection attempts against the deployment.
- Verify the deployed version after updating.
Management note
A broken content security policy is a quiet hole: nothing alerts until something gets through. Apply IBM’s fix and re-check the policy.