CVE-2026-127036: ibi WebFOCUS - Reflected XSS & OS Command Injection Vulnerability
Published Nov 12, 2026
·Updated
Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS.
This issue affects WebFOCUS: 9.1, from 9.2 through 7, and from 9.3 through 7.
Event History
Nov 12, 2026
CVE Published
via MITRE·11:34 AM
Data Sourced
via MITRE·11:34 AM
DescriptionWeakness
Data Sourced
via NVD·12:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which WebFOCUS versions are affected?
The issue affects WebFOCUS 9.1, versions from 9.2 through 7, and versions from 9.3 through 7, as stated in the advisory data.
2
What access does an attacker need to exploit this issue?
The supplied CVSS vector indicates that exploitation is network-accessible, requires high privileges, and does not require user interaction.