CVE-2026-1243
Cross-Site Scripting in IBM Content Navigator Risks Credential Disclosure
Publication date: 2026-04-02
Last updated on: 2026-04-07
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | content_navigator | 3.0.15 |
| ibm | content_navigator | 3.1.0 |
| ibm | content_navigator | 3.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1243 is a Cross-Site Scripting (XSS) vulnerability found in IBM Content Navigator versions 3.0.15, 3.1.0, and 3.2.0. It allows an authenticated user to inject arbitrary JavaScript code into the web user interface.
This injected code can alter the intended functionality of the application, potentially leading to the disclosure of user credentials within a trusted session.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an authenticated user to execute arbitrary JavaScript code in the web interface, which may alter application behavior.
This can lead to the disclosure of credentials within a trusted session, potentially compromising user accounts and sensitive information.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in IBM Content Navigator versions 3.0.15, 3.1.0, and 3.2.0 can be mitigated by applying the available interim fixes specific to each version.
- For ICN 3.0.15, apply interim fix IF009.
- For ICN 3.1.0, apply interim fix IF008 LA2.
- For ICN 3.2.0, apply interim fix IF004.
No other workarounds or mitigations are provided, so applying these fixes promptly is the recommended immediate action.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an authenticated user to inject arbitrary JavaScript code into the Web UI, potentially leading to credential disclosure within a trusted session.
Such credential disclosure could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive information and user credentials.
However, the provided information does not explicitly discuss the direct effects on compliance with these standards or regulations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or network/system scanning methods provided for this vulnerability in the available resources.
The vulnerability affects IBM Content Navigator versions 3.0.15, 3.1.0, and 3.2.0 and involves an authenticated user injecting arbitrary JavaScript code into the Web UI.
Detection would likely require verifying the version of IBM Content Navigator in use and checking for the presence of the vulnerability by testing authenticated user input handling in the Web UI.
No specific commands or automated detection tools are mentioned in the provided information.