The flaw arises from an inadequate Content Security Policy configuration, which permits attackers to inject malicious scripts into the application. When the compromised page is rendered in a victim’s browser, the injected code executes with the privileges of the authenticated user, enabling the attacker to alter page behavior, exfiltrate data, or carry out other unauthorized actions within the application context.

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 are affected. The issue is documented for both the 8.6.1.0 and 8.6.2.2 release lines.

The CVSS score of 9.1 indicates a high severity vulnerability. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is through the publicly exposed web interface, where a malicious user can supply crafted input that bypasses CSP enforcement and triggers XSS. Because the default configuration does not provide mitigations for this weakness, an attacker can potentially exploit the flaw without special conditions, leading to significant confidentiality, integrity, and availability risks.