CVE-2016-9696: IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to HTML injection.

Security readout for executives and security teams

IBM Rhapsody Design Manager has an HTML injection flaw. A remote attacker could place malicious HTML that runs in another user’s browser under the application’s site context. This can threaten user trust, session safety, and data shown in the web interface, but the source bundle does not provide CVSS, patch details, or confirmed exploitation. Exposure is likely limited to organizations running IBM Rational Rhapsody Design Manager, especially listed 3.x through 6.0.x versions. Risk increases if the web interface is reachable by broad internal user groups or exposed beyond trusted networks. Treat as a targeted application risk, not a broad internet emergency based on the provided evidence. Prioritize if Rhapsody DM supports sensitive engineering workflows or is accessible to many users. Mitigation focus: Review IBM advisory 1999960 for vendor-approved fixes or mitigations.; Inventory all Rational Rhapsody Design Manager deployments and versions.; Restrict web interface access to trusted networks and users..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.