CVE-2016-9694: IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.

Security readout for executives and security teams

This flaw lets a user place JavaScript into the IBM Rhapsody Design Manager web interface. If another trusted session loads that content, the script could alter page behavior and potentially expose credentials. The provided sources do not give a CVSS score or confirm active exploitation. Exposure is likely limited to organizations running IBM Rational Rhapsody Design Manager web deployments, especially the listed 3.x through 6.0.3 versions. Risk increases where the application is reachable by broad internal users or external networks. Treat this as a moderate-risk legacy application issue. It is not shown as actively exploited in the provided evidence, but credential exposure inside trusted sessions can create business impact if vulnerable deployments remain accessible. Mitigation focus: Identify all IBM Rational Rhapsody Design Manager instances and versions.; Review IBM advisory 1999960 for vendor-confirmed fixes or workarounds.; Prioritize upgrades or mitigations for listed affected versions..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.