IBM Netcool/OMNIbus Web GUI stored XSS can expose credentials
- ibm
- omnibus
- xss
IBM's 6 November advisory covers a stored cross-site scripting flaw in Tivoli Netcool/OMNIbus Web GUI 8.1.0 through 8.1.0.41. Apply Fix Pack 42 (8.1.0.42) to close it.
On 6 November 2026, IBM published an advisory for a stored cross-site scripting flaw in Tivoli Netcool/OMNIbus Web GUI. An authenticated user can embed JavaScript in the Web UI, which can change how the interface behaves and may lead to credential disclosure in a trusted session. IBM has not reported exploitation.
The bugs
CVE-2026-115554, stored cross-site scripting. It affects IBM Tivoli Netcool/OMNIbus Web GUI 8.1.0 through 8.1.0.41. An authenticated user can embed JavaScript in the Web UI. IBM scores it 6.4.
The remedy
Updating is the complete fix. Apply Fix Pack 42, also listed as 8.1.0.42 and 8.1.0-TIV-NCOMNIbus_GUI-FP0042.
- IBM Tivoli Netcool/OMNIbus Web GUI: Fix Pack 42 (8.1.0.42)
After the update, confirm the running Web GUI is 8.1.0.42 on the System Information for Netcool/OMNIbus Web GUI page, not only that the fix pack download finished.
If you cannot update today
No setting makes an unpatched Web GUI safe. IBM lists no workarounds or temporary measures. Apply Fix Pack 42 as soon as you can.