CVE-2016-6037: IBM Rational Team Concert (RTC) is vulnerable to HTML injection.

Security readout for executives and security teams

IBM Rational Team Concert within Rational Collaborative Lifecycle Management can let a project administrator place malicious HTML in a project. When another user views that project, the HTML can run in the user’s browser as part of the trusted site. This is not reported as KEV-exploited in the provided sources. Exposure is limited to organizations running the listed IBM Rational Collaborative Lifecycle Management or RTC versions, especially where project administrator privileges are broadly assigned or poorly reviewed. Give this attention where legacy IBM CLM is still business-critical. The privilege requirement lowers urgency, but browser execution inside a trusted engineering platform can affect confidentiality and user trust. Mitigation focus: Check IBM advisory swg22002429 for vendor-approved fixes or mitigations.; Inventory RTC or CLM instances and compare versions against the affected list.; Restrict project administrator privileges to trusted users only..

Prepared

Jun 13, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.