CVE-2015-0158: Cross-site scripting (XSS) vulnerability in the Coach NG framework in IBM Business Process Manager (BPM) 8....

Security readout for executives and security teams

CVE-2015-0158 is a cross-site scripting issue in IBM Business Process Manager's Coach NG framework. An attacker could use a crafted URL to inject script or HTML into a user's browser. This can support phishing, session abuse, or misleading workflow actions, depending on how BPM is used. Exposure is most likely where legacy IBM BPM versions in the listed ranges remain deployed and Coach NG web interfaces are reachable by users or remote clients. The bundle does not identify other IBM products or later versions as affected. Treat this as a legacy enterprise application risk. It is not shown as actively exploited in the supplied sources, but affected BPM systems may handle sensitive workflow data and user sessions. Remediate during normal vulnerability cycles unless the interface is internet-facing or business-critical. Mitigation focus: Inventory IBM BPM deployments and compare versions against the listed affected ranges.; Review IBM APARs JR52137, JR52322, JR52355, and IBM advisory swg21696378.; Apply only IBM-documented fixes, fix packs, or workarounds for the exact BPM version..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.