CVE-2016-2973: IBM Sametime Media Services 8.5.2 and 9.0 is vulnerable to cross-site scripting.

Security readout for executives and security teams

CVE-2016-2973 is a cross-site scripting issue in IBM Sametime Media Services. A user could place JavaScript into the Web UI and change what another trusted session sees or does, potentially exposing credentials. The provided sources do not include a CVSS score or evidence of active exploitation. Exposure is likely limited to organizations still operating affected IBM Sametime Media Services versions, especially where the Web UI is reachable by many users or externally accessible. The source bundle does not identify affected configurations beyond the listed versions. Treat this as a legacy-platform risk requiring inventory and vendor-guided remediation. It is not supported here as actively exploited, but credential exposure through a trusted collaboration session can create meaningful business impact if affected Sametime systems remain in use. Mitigation focus: Check IBM advisory and X-Force ID 113899 for vendor-approved fixes or workarounds.; Identify and retire or upgrade affected Sametime Media Services versions where possible.; Restrict Web UI access to trusted networks and authenticated users only..

Prepared

Jun 12, 2026, 21:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.