IBM Datacap EUVD-2026-38282

The vulnerability exists in the IBM Datacap and IBM Datacap Navigator Web UI, and requires that a victim user with an active authenticated session interact with an attacker-controlled input or URL - reflecting the UI:R CVSS metric. The attacker themselves requires no authentication (PR:N per CVSS). The Web UI must be accessible to the attacker, either directly or via a crafted link delivered to an internal user. Exploitation is limited by the requirement for victim interaction and the need to target users who are actively logged into the Datacap Web UI. There is no indication of a non-default configuration being required; the vulnerability appears to affect the standard Web UI deployment across all listed versions.

The vendor-assigned CVSS score is 6.1 (Medium), with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. However, the AV:L (Local) attack vector is inconsistent with a Web UI XSS vulnerability, which is inherently delivered over a network - this appears to be a miscalculation in the vendor's CVSS assignment and should be verified against the IBM advisory. A more accurate assessment would use AV:N, which would raise the base score. The S:C (Scope Changed) metric is correctly applied, reflecting that the attacker's script executes in a browser context outside the vulnerable component. User interaction is required (UI:R), which limits opportunistic mass exploitation. No EPSS data was provided, no KEV listing exists, and no public exploit code has been identified, suggesting this is not currently under active targeted exploitation. Despite the medium CVSS score, credentials disclosure from an enterprise document management platform in a trusted session context represents meaningful organizational risk, particularly given the unauthenticated attack surface (PR:N).

An unauthenticated attacker identifies a reflected or stored XSS injection point in the IBM Datacap Web UI and crafts a malicious URL or input payload containing JavaScript designed to exfiltrate session cookies or capture credentials. The attacker delivers this payload to an authenticated Datacap user via phishing email or a malicious link; when the victim interacts with the link in their authenticated session, the injected script executes in their browser and transmits credentials or session tokens to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the attack is technically straightforward for any actor with basic XSS knowledge.