A critical security flaw in IBM WebSphere Extreme Scale could allow a remote attacker to bypass security restrictions and inject malicious script into web pages viewed by users. The vulnerability, tracked as CVE-2026-101117, carries a CVSS 3.1 score of 9.1, putting it in the critical range. The CVE record was published on 8 November 2026, although IBM's security bulletin first mentioned the flaw on 23 October.

The flaw affects the Liberty deployment of WebSphere eXtreme Scale, IBM's in-memory data grid platform. Versions 8.6.1.0 through 8.6.2.2 are affected. According to the official advisory text, the product could allow a remote attacker to bypass security restrictions because of an improper Content Security Policy configuration. Content Security Policy is the browser mechanism that limits which scripts and other resources a web page is allowed to load, so a weakness in how it is set up can open the door to cross-site scripting attacks.

In a cross-site scripting attack, an attacker injects malicious script into a web page that a victim then opens in their browser. That script can run with the trust the victim's browser places in the site, which can expose sensitive data or change how the application behaves. The vulnerability database Feedly describes the impact in those terms: an unauthenticated attacker over the network can bypass Content Security Policy restrictions to read sensitive data and modify application content or behaviour.

The CVSS vector for the flaw is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. In plain terms, the attack can be carried out over the network, it is not complex, it needs no privileges and no user interaction, and it can have a high impact on the confidentiality and integrity of data, with no direct impact on availability. The weakness is classified as CWE-16, a configuration weakness.

There is no evidence at present that the flaw is being exploited in the wild, and no public proof-of-concept exploit has been reported. That does not mean organisations running the affected versions can ignore it. A critical, network-reachable flaw with no user interaction required is exactly the kind of weakness attackers scan for once details become widely known, and the publication of the CVE record on 8 November puts the details in front of a much wider audience.

Administrators should check which version of WebSphere eXtreme Scale they are running and review how Content Security Policy is configured on their deployments. Feedly reports that a patch is available and advises updating to a version later than 8.6.2.2, as well as reviewing and verifying that Content Security Policy configurations are properly enforced. The CVE record itself does not name a fixed version, so administrators should consult IBM's security bulletin for the latest fix and apply it in line with their own change process. Monitoring for suspicious network activity aimed at WebSphere eXtreme Scale instances is also advisable while patching is under way.

The flaw is a reminder that security problems are not always buried deep in application code. A misconfigured policy can be just as dangerous as a coding error, particularly in enterprise middleware that sits behind customer-facing applications. Organisations that run WebSphere eXtreme Scale as part of a wider IBM stack should also check whether bundled products carry the same affected component and need the same update.