CVE-2026-15091 is a critical cross-site scripting (CWE-79) vulnerability in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0. The vulnerability arises from improper neutralization of input during web page generation, enabling remote attackers to execute arbitrary scripts. The CVSS v3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity with no impact on availability. No official fix or patch has been announced, and the product is not a cloud service, so remediation depends on IBM's future advisories.

Successful exploitation could allow remote attackers to execute arbitrary scripts in the context of the affected IBM Engineering AI Hub application, potentially leading to complete compromise of confidentiality and integrity of user data and sessions. This could enable theft of sensitive information or unauthorized actions within the application. Availability is not impacted according to the CVSS vector. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been announced by IBM, users should monitor IBM's security advisories for updates. Until a patch is available, consider applying web application firewalls or input validation controls where possible to mitigate exploitation risk. Avoid exposing the affected versions to untrusted networks if feasible.