CVE-2026-1243
Received Received - Intake
Cross-Site Scripting in IBM Content Navigator Risks Credential Disclosure

Publication date: 2026-04-02

Last updated on: 2026-04-07

Assigner: IBM Corporation

Description
IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-02
Last Modified
2026-04-07
Generated
2026-06-16
AI Q&A
2026-04-02
EPSS Evaluated
2026-06-15
NVD
CVE-2026-1243
EUVD
EUVD-2026-18112
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
ibm content_navigator 3.0.15
ibm content_navigator 3.1.0
ibm content_navigator 3.2.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

There are no specific detection commands or network/system scanning methods provided for this vulnerability in the available resources.

The vulnerability affects IBM Content Navigator versions 3.0.15, 3.1.0, and 3.2.0 and involves an authenticated user injecting arbitrary JavaScript code into the Web UI.

Detection would likely require verifying the version of IBM Content Navigator in use and checking for the presence of the vulnerability by testing authenticated user input handling in the Web UI.

No specific commands or automated detection tools are mentioned in the provided information.

Executive Summary

CVE-2026-1243 is a Cross-Site Scripting (XSS) vulnerability found in IBM Content Navigator versions 3.0.15, 3.1.0, and 3.2.0. It allows an authenticated user to inject arbitrary JavaScript code into the web user interface.

This injected code can alter the intended functionality of the application, potentially leading to the disclosure of user credentials within a trusted session.

Impact Analysis

The vulnerability can impact you by allowing an authenticated user to execute arbitrary JavaScript code in the web interface, which may alter application behavior.

This can lead to the disclosure of credentials within a trusted session, potentially compromising user accounts and sensitive information.

Mitigation Strategies

The vulnerability in IBM Content Navigator versions 3.0.15, 3.1.0, and 3.2.0 can be mitigated by applying the available interim fixes specific to each version.

  • For ICN 3.0.15, apply interim fix IF009.
  • For ICN 3.1.0, apply interim fix IF008 LA2.
  • For ICN 3.2.0, apply interim fix IF004.

No other workarounds or mitigations are provided, so applying these fixes promptly is the recommended immediate action.

Compliance Impact

The vulnerability allows an authenticated user to inject arbitrary JavaScript code into the Web UI, potentially leading to credential disclosure within a trusted session.

Such credential disclosure could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive information and user credentials.

However, the provided information does not explicitly discuss the direct effects on compliance with these standards or regulations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart