CVE-2016-2967: IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting.

Security readout for executives and security teams

IBM Sametime 8.5.2 and 9.0 family allowed JavaScript to be placed in a user's away message. If viewed inside a trusted Sametime session, that script could alter expected behavior and potentially expose credentials. The sources do not provide CVSS scoring or evidence of active exploitation. Exposure is most likely in organizations still operating legacy IBM Sametime 8.5.2 or 9.0 deployments, including listed maintenance releases. Systems retired, isolated, or upgraded outside the affected versions are less likely to be exposed, but version confirmation is required. Treat this as a legacy collaboration-platform risk. It is not listed as actively exploited in the supplied sources, but credential exposure inside trusted sessions can matter. Prioritize confirmation and vendor-guided remediation where Sametime remains in production. Mitigation focus: Review IBM advisory swg22006441 for vendor-provided fixes or interim guidance.; Inventory Sametime deployments and identify affected 8.5.2 and 9.0 family versions.; Upgrade or apply IBM-supplied remediation where available..

Prepared

Jun 12, 2026, 21:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.