home / blog
2026-11-08 · critical
CVE-2026-101117: CSP Bypass in IBM WebSphere Extreme Scale
IBM WebSphere Extreme Scale: CSP bypass in 8.6.1.0-8.6.2.2 (CVSS 9.1), critical impact on enterprise environments.
CVE-2026-101117 affects IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.2.2. The vulnerability stems from improper Content Security Policy configuration, allowing a remote attacker to bypass security restrictions. It impacts enterprise environments relying on WebSphere Extreme Scale for distributed data grids and caching.
The vulnerability carries a CVSS score of 9.1 and is classified as critical by IBM. It was published on NVD on 2026-11-08. Social signals on X show emerging awareness (2 posts in the last 24 hours with minimal interactions), but no confirmed public exploitation has been reported. No official patch has been confirmed yet.
Security teams should immediately identify production instances of WebSphere Extreme Scale 8.6.1.0-8.6.2.2. Monitor environments for CSP bypass attempts and unauthorized access. Contact IBM support for patch information. In the interim, consider alternative configurations or network isolation where feasible, and maintain detailed logs of access and requests.
Content Security Policy (CSP) is a critical mechanism for preventing XSS attacks and content injection. A CSP bypass can expose applications to significant risks. The critical rating of CVE-2026-101117 reflects its potential impact on environments processing sensitive data requiring high reliability.
At a glance
- What
- IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.2.2: improper Content Security Policy configuration allows remote attacker to bypass security restrictions.
- Severity
- CVSS 9.1 (critical). Declared critical by IBM.
- Affected versions
- 8.6.1.0 through 8.6.2.2
- Fix
- No confirmed patch available at time of publication (2026-11-08). Contact IBM support for update information.
- Status
- Published on NVD 2026-11-08. No GitHub signal of public exploit. Minimal social signals on X (2 posts in 24 hours). No confirmed public exploitation reported.
- Action
- Identify production instances of WebSphere 8.6.x; monitor logs for CSP bypass attempts and anomalous access; contact IBM for patch timing; evaluate network isolation or alternative configurations; maintain detailed access audit trail.
Sources: NVD, CVE-2026-101117