CVE-2016-9732: IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting.

Security readout for executives and security teams

IBM Curam Social Program Management versions 6.0, 6.1, 6.2, and 7.0 have a cross-site scripting issue. A user could place JavaScript into the Web UI, changing page behavior and potentially exposing credentials inside a trusted session. Exposure is limited to organizations running the listed IBM Curam Social Program Management versions. Internet-facing or broadly accessible Curam portals would carry more business risk, but the bundle does not confirm deployment patterns or authentication requirements. Treat this as a moderate-priority remediation item for any active Curam environment. It is not listed as known exploited in the supplied evidence, but credential exposure inside trusted sessions can create meaningful account and data risk. Mitigation focus: Inventory IBM Curam Social Program Management versions in production and support environments.; Review IBM advisory swg22007156 and X-Force ID 119761 for official fixes or guidance.; Engage IBM support if the advisory is unavailable or remediation status is unclear..

Prepared

Jun 12, 2026, 21:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.