CVE-2016-8935: IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting.

Security readout for executives and security teams

IBM Kenexa LMS on Cloud had a cross-site scripting weakness that could let a user place JavaScript into the web interface. In a trusted user session, that script could change page behavior and potentially expose credentials. Exposure is limited to organizations using IBM Kenexa LMS on Cloud in the affected version ranges. Confirm exact tenant version and maintenance status with IBM because the provided sources contain incomplete scoring and version detail. Treat as a targeted business-system risk, not an internet-wide emergency. Prioritize if the LMS holds sensitive workforce data, uses broad internal access, or remains on an affected unsupported version. Mitigation focus: Check IBM advisory 1999483 for the vendor-supported fix or upgrade path.; Confirm current Kenexa LMS on Cloud version and support status with IBM.; Restrict access to trusted users and networks where operationally feasible..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.