What is the CVSS score of CVE-2026-8059?

CVE-2026-8059 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-8059?

Yes, a patch is available for CVE-2026-8059. Update the affected software to the latest version immediately.

IBM Datacap CVE-2026-8059

EUVD-2026-38282 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-22 ibm

GHSA-8pwc-hwv4-w6j6

XSS IBM Datacap Datacap Navigator

6.1

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Web UI XSS is network-delivered (AV:N); no auth required (PR:N); victim interaction needed (UI:R); scope changes to browser (S:C); no direct availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 16:06 vuln.today

DescriptionNVD

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

AnalysisAI

Cross-site scripting in IBM Datacap and Datacap Navigator 9.1.7 through 9.1.9 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript within the Web UI, targeting authenticated users during active sessions. Successful exploitation can lead to credential theft or session hijacking by abusing the trust context of a legitimate user's browser. No public exploit code has been identified at time of analysis, and IBM has released a patch via official advisory.

Technical ContextAI

IBM Datacap and IBM Datacap Navigator are enterprise document capture and processing platforms with a browser-based Web UI. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), indicating that user-controllable input is rendered in the Web UI without adequate output encoding or sanitization. This allows attacker-controlled JavaScript to execute in the security context of a victim user's browser session. Affected products are identified by CPE strings cpe:2.3:a:ibm:datacap:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:datacap_navigator:*:*:*:*:*:*:*:*, covering versions 9.1.7, 9.1.8, and 9.1.9 of both products.

RemediationAI

Apply the vendor-released patch per IBM's official advisory at https://www.ibm.com/support/pages/node/7276609. An exact fixed version number was not independently confirmed from the available data; consult the advisory directly to identify the specific patched release for your Datacap or Datacap Navigator installation. As a compensating control prior to patching, restrict access to the Datacap and Datacap Navigator Web UI to trusted internal networks or VPN-only access to reduce the unauthenticated attack surface, though this does not eliminate the vulnerability for internal threat actors. Implementing a Web Application Firewall with XSS filtering rules may provide partial mitigation but should not be relied upon as a primary control. Monitor Web UI access logs for anomalous input patterns indicative of XSS probe activity.