IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 has a critical-rated (CVSS 9.1) flaw: an improperly configured Content Security Policy could let a remote, unauthenticated attacker bypass security restrictions.
What Is It
CVE-2026-101117 is a security restriction bypass in IBM WebSphere Extreme Scale. According to IBM's PSIRT, the root cause is an improperly configured Content Security Policy (CSP). The weakness is classified as CWE-16 (Configuration).
IBM published the record on November 8, 2026. NVD lists its status as "Awaiting Analysis," so NVD has not yet published its own assessment. The available scoring and details come from IBM as the CVE source.
Why It Matters
IBM rates the vulnerability CVSS 3.1 9.1 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. In practice:
- Network-reachable: an attacker can exploit it remotely.
- Low attack complexity: no special conditions are needed.
- No privileges or user interaction: an unauthenticated attacker can trigger it with no action from a victim.
- High confidentiality and integrity impact: successful exploitation could expose or change data. Availability impact is rated none.
Exploitation status: CVE-2026-101117 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the supplied data does not confirm active exploitation. Given the critical score and the low barrier to exploitation, organizations running affected versions should still prioritize it.
What's Vulnerable
- Vendor: IBM
- Product: WebSphere Extreme Scale
- Affected versions: 8.6.1.0 through 8.6.2.2 (inclusive)
The CPE entries in the record mark the endpoints of the affected range:
cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:websphere_extreme_scale:8.6.2.2:*:*:*:*:*:*:*
Patch Status
The supplied NVD data does not give a fixed version or specific remediation steps. Because the entry is not in KEV, CISA has not issued a required action or due date.
IBM has published a support page for this issue, linked below. Administrators should:
- Check which WebSphere Extreme Scale version they run against the affected range of 8.6.1.0 through 8.6.2.2.
- Follow IBM's advisory for remediation guidance and any available fix.
- Re-check the NVD record and the KEV catalog for updated analysis or exploitation status.
Sources
- IBM Support – Security Bulletin (node 7293764)
- NVD – CVE-2026-101117
- CISA Known Exploited Vulnerabilities Catalog (not listed as of publication)