{"id":"CVE-2026-9870","aliases":[],"cve":{"records":[{"id":"CVE-2026-9870","source":"ibm","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-05-28T17:18:38.929Z","published":"2026-11-13T21:35:56.221Z","modified":"2026-11-13T21:35:56.221Z"}],"publishers":[{"name":"ibm","role":"CNA","organizationId":"9a959283-ebb5-44b6-b705-dcc2bbced522","modified":"2026-11-13T21:35:56.221Z"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7295966","tags":["vendor-advisory","patch"],"source":"ibm"}],"weaknesses":[{"id":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation","source":"ibm"}],"applicability":[],"prioritization":[]},"title":"IBM Cyber Fraud includes components with multiple known vulnerabilities","titleSource":"ibm","descriptionSource":"ibm","description":"IBM Cyber Fraud 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","score":6.1,"severity":"medium","published":"2026-11-13T21:35:56.221Z","modified":"2026-11-13T21:35:56.221Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"IBM","name":"Cyber Fraud","platforms":[],"versions":[{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.1.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:cyber_fraud:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:cyber_fraud:1.1.0:*:*:*:*:*:*:*"],"source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-9870"}],"remediation":[{"text":"IBM strongly encourages customers to update their systems promptly.\n\n\n\nPlease upgrade to at least version 1.1.1 according to the following instructions:\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud \n\n\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud","source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-9870"}],"references":["https://www.ibm.com/support/pages/node/7295966"],"sources":[{"name":"CVE","id":"CVE-2026-9870","modified":"2026-11-13T21:35:56.221Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-9870"}],"assessments":[{"source":"ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}],"sourceAffected":[],"observedAt":"2026-11-13T22:15:07.899Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:00:32.242Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-13T22:45:35.790Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-13T22:45:39.189Z","attemptedAt":"2026-11-13T22:45:39.189Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T22:45:38.919Z","attemptedAt":"2026-11-13T22:45:38.919Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T22:45:40.161Z","attemptedAt":"2026-11-13T22:45:40.161Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-125782","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125782","modified":"Nov 13, 2026, 9:35:56 PM","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-11-13T22:45:38.919Z"}],"aiSummary":{"text":"IBM Cyber Fraud 1.0.0 through 1.1.0 has a cross-site scripting vulnerability, allowing an unauthenticated attacker to embed arbitrary JavaScript code, potentially leading to credentials disclosure. The weakness is due to improper neutralization of input during web page generation. An attacker can alter the intended functionality of the Web UI.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T22:21:05.690Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-9870"}]}}