SECURITYCRITICALCVE-2026-101117

CVE-2026-101117: IBM WebSphere Extreme Scale Improper CSP Configuration Enables Security Restriction Bypass

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 has an improper Content Security Policy configuration that lets a remote attacker bypass restrictions (CVSS 9.1).

Dylan H.

Security Team

November 9, 2026
3 min read
CVE-2026-101117: IBM WebSphere Extreme Scale Improper CSP Configuration Enables Security Restriction Bypass

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2

CVE-2026-101117: IBM WebSphere Extreme Scale CSP Bypass

A critical vulnerability, CVE-2026-101117, was published to the NVD on 2026-11-08 and affects IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2. Per the NVD description, an improper Content Security Policy (CSP) configuration could allow a remote attacker to bypass security restrictions. The record carries a CVSS score of 9.1.

At the time of writing, the public record is brief. No exploitation in the wild has been reported, and details such as the exact vulnerable component and the vendor fix level were not included in the NVD entry. Check IBM's security bulletin for the authoritative remediation guidance.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-101117
CVSS Score9.1 (Critical)
WeaknessImproper Content Security Policy configuration
Affected ProductIBM WebSphere Extreme Scale
Affected Versions8.6.1.0 through 8.6.2.2
Attack VectorRemote attacker
ImpactBypass of security restrictions
Published2026-11-08
SourceNIST NVD

What a CSP Weakness Means

A Content Security Policy is a browser-enforced allow-list that restricts where scripts, frames, and other content may load from. When it is misconfigured, for example overly permissive or missing directives, protections that normally contain cross-site scripting and content injection can be weakened or sidestepped. Here the NVD states only that security restrictions can be bypassed; it does not describe a specific exploit chain.

Remediation

  1. Inventory WebSphere Extreme Scale deployments and identify any running 8.6.1.0 through 8.6.2.2.
  2. Consult the IBM security bulletin for this CVE and apply the fix or interim fix it specifies.
  3. Review response headers on any web-facing management consoles or services for Content-Security-Policy and confirm directives are restrictive.
  4. Limit exposure by keeping administrative interfaces off the public internet and behind VPN or network ACLs until patched.
# Check the CSP header returned by an exposed endpoint (replace the host)
curl -sI https://your-host.example.com/ | grep -i content-security-policy

Key Takeaways

  1. CVE-2026-101117 is rated CVSS 9.1 and affects IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2.
  2. The flaw is an improper CSP configuration that may let a remote attacker bypass security restrictions.
  3. Public details are limited; follow IBM's bulletin for the fixed version.
  4. Restrict network access to affected systems until patched.

Sources