# CVE-2026-8059: IBM Datacap cross-site scripting in Navigator Web UI

Source: https://junglewise.ai/threats/cve-2026-8059-ibm-datacap-cross-site-scripting-in-navigator-web-ui  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-8059 · Severity: medium · CVSS 6.1 · Published 2026-06-22

IBM Datacap, a document capture and data extraction platform, is vulnerable to a security flaw in its web interface. An attacker could trick a user into executing malicious scripts, which may allow the attacker to steal login credentials or modify what the user sees on the screen. This could compromise sensitive business data processed by the system.

Technologies: [IBM Datacap](https://junglewise.ai/threats/technologies/datacap), [IBM Datacap Navigator](https://junglewise.ai/threats/technologies/datacap-navigator). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-8059 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8059 being exploited in the wild.

**How severe is CVE-2026-8059?** Medium severity, with a CVSS score of 6.1, published 22 June 2026.

**Which products and versions are affected?** IBM Datacap 9.1.7, 9.1.8, 9.1.9; IBM Datacap Navigator 9.1.7, 9.1.8, 9.1.9.

**Is there a fix for CVE-2026-8059?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8059 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-8059?** Check whether you run IBM Datacap or IBM Datacap Navigator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

IBM Datacap and Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9 are affected by a cross-site scripting (XSS) vulnerability (CWE-79). The flaw exists in the Web UI component due to improper neutralization of user-supplied input during web page generation. Although the CVSS vector indicates a local attack vector (AV:L), the nature of XSS typically involves a remote attacker tricking a local user into interacting with a malicious link or crafted input. Successful exploitation allows an unauthenticated attacker to embed arbitrary JavaScript code within a trusted session, potentially leading to the disclosure of session credentials or unauthorized modification of the application's functionality. IBM has released Datacap 9.1.9 Interim Fix 008 to address this issue.

## Affected products

- IBM Datacap 9.1.7, 9.1.8, 9.1.9
- IBM Datacap Navigator 9.1.7, 9.1.8, 9.1.9

## Timeline

- 2026-06-16: advisory: Initial publication by IBM
- 2026-06-22: disclosed: NVD publication date

## References

- [https://www.ibm.com/support/pages/node/7276609](https://www.ibm.com/support/pages/node/7276609)

## Related threats

- [IBM Datacap forced browsing access control bypass](https://junglewise.ai/threats/cve-2026-9610-ibm-datacap-forced-browsing-access-control-bypass)
- [IBM Datacap sensitive information disclosure in memory](https://junglewise.ai/threats/cve-2026-8636-ibm-datacap-sensitive-information-disclosure-in-memory)