CVE-2026-15091 is a critical cross-site scripting vulnerability (CWE-79) affecting IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0. The vulnerability arises from improper neutralization of input during web page generation, enabling remote attackers to execute arbitrary scripts. The CVSS 3.1 base score is 9.3, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. No vendor advisory or patch is currently available, and the product is not a cloud service, so remediation depends on IBM providing an update.

Successful exploitation could allow remote attackers to execute arbitrary scripts in the context of the affected IBM Engineering AI Hub application, potentially leading to disclosure or modification of sensitive information. The vulnerability does not impact availability. The high CVSS score reflects critical impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been published by IBM at this time. Users should monitor IBM's security advisories for updates and consider applying any future patches promptly.