Stored Cross-Site Scripting in IBM Tivoli Netcool/OMNIbus Leading to Credential Exposure
CVE-2026-115554

6.4MEDIUM

Key Information:

Vendor

IBM
Status
Tivoli Netcool/omnibus
Vendor
CVE Published:
8 November 2026

What is CVE-2026-115554?

IBM Tivoli Netcool/OMNIbus versions 8.1.0 through 8.1.0.41 exhibit a weakness that enables authenticated users to inject malicious JavaScript into the Web UI. This manipulation can disrupt the expected functionality of the application, allowing for potential credential disclosure during active user sessions. Remediation should be undertaken promptly to safeguard user data and maintain system integrity.

Affected Version(s)

Tivoli Netcool/OMNIbus 8.1.0 <= 8.1.0.41

References

https://www.ibm.com/support/pages/node/7295828
vendor-advisorypatch

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.