EUVD-2026-15989
GHSA-2x38-48vp-w23x
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) indicates moderate real-world risk: while the attack vector is network-based with low complexity, the requirement for high privileges (PR:H) and user interaction (UI:R) significantly constrains exploitability. The impact is limited to confidentiality and integrity (C:L/I:L) with no availability impact. Compared to high-CVSS vulnerabilities with lower privilege requirements, this poses less strategic risk to most organizations, though it remains critical in zero-trust or least-privilege environments where privileged account compromise is a primary concern. The availability of a vendor patch and lack of reported active exploitation further reduce immediate risk, though the vulnerability should still be addressed systematically to prevent insider threats and privilege-escalation chains. |
| Exploit ScenarioDerived | An internal threat actor or compromised high-privileged administrative account injects a malicious JavaScript payload into a stored configuration field or metadata field in Infosphere Information Server. When other administrators or authorized users access the Web UI dashboard, the injected script executes in their browser context within the same trusted session, allowing the attacker to steal session cookies, capture credentials entered into forms, or perform unauthorized actions on behalf of the victim. The requirement for high privileges and user interaction makes this most effective in targeted insider threat scenarios or as a post-compromise persistence mechanism following initial privileged account compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
IBM Infosphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a stored cross-site scripting (XSS) vulnerability in the Web UI that allows privileged users to inject arbitrary JavaScript code, potentially leading to credential disclosure and session compromise. While a vendor patch is available, the attack requires high privileges and user interaction, resulting in a moderate CVSS score of 4.8. This vulnerability does not appear to have active exploitation in the wild or public proof-of-concept code, but should be prioritized for organizations running vulnerable versions in security-sensitive environments.
RemediationAI
Upgrade IBM Infosphere Information Server to version 11.7.1.7 or later, following the vendor's official patch guidance at https://www.ibm.com/support/pages/node/7266765. Organizations unable to patch immediately should implement compensating controls: restrict Web UI access to trusted IP ranges via firewall rules, enforce multi-factor authentication for all privileged accounts to reduce the risk of credential-based exploitation, conduct periodic access reviews to minimize unnecessary high-privilege assignments, and enable web application firewall (WAF) rules to detect and block common XSS payloads in request parameters. Monitor application logs for suspicious JavaScript injection attempts in stored data fields.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw where user-controlled input is not properly sanitized before being persisted in the application database and subsequently rendered in the Web UI without output encoding. IBM Infosphere Information Server (CPE: cpe:2.3:a:ibm:infosphere_information_server) is an enterprise data integration and governance platform that processes and displays user-supplied data in web-based dashboards and configuration interfaces. The affected versions 11.7.0.0 through 11.7.1.6 fail to implement adequate input validation or output encoding mechanisms in specific Web UI components, allowing an authenticated administrator or high-privileged user to embed malicious JavaScript payloads that execute in the context of other users' trusted sessions.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
IBM Infosphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Executive ViewAI
Organizations using IBM Infosphere Information Server 11.7.0.0 through 11.7.1.6 should be aware of moderate risk from CVE-2026-2485, a cross-site scripting vulnerability rated CVSS 4.8. Attackers could inject scripts to steal sessions or perform actions as authenticated users. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB