CVE-2016-9990: IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting.

Security readout for executives and security teams

IBM iNotes versions in the 8.5 and 9.0 families have a cross-site scripting flaw. A malicious or compromised user could inject JavaScript into the web interface, changing what another user sees and potentially stealing credentials during a trusted session. Exposure is most likely in organizations still running legacy IBM iNotes 8.5, 8.5.x, 9.0, or listed 9.0.1 builds, especially where iNotes is broadly reachable by employees or external users. Treat this as a legacy webmail risk requiring timely remediation where IBM iNotes remains in use. It is not KEV-listed, but credential theft from trusted sessions can create business impact if exposed systems are still active. Mitigation focus: Review IBM advisory 1998824 for supported fixes or interim guidance.; Inventory all IBM iNotes deployments and versions in production and legacy environments.; Prioritize remediation for internet-accessible or broadly accessible webmail instances..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.