Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities found for webMethods Integration (on prem) by IBM
CVE-2026-12118 (GCVE-0-2026-12118)
Vulnerability from nvd – Published: 2026-07-30 17:00 – Updated: 2026-07-30 17:41
VLAI
EPSS
VEX
Title
IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
Summary
IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7278857 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | webMethods Integration (on prem) |
Affected:
10.15, 10.11
cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15:*:*:*:*:*:*:* cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12118",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T17:40:56.010338Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T17:41:17.032Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15.0:*:*:*:*:*:*:*"
],
"product": "webMethods Integration (on prem)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "10.15, 10.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This vulnerability was reported to IBM by Black Lantern Security (https://www.blacklanternsecurity.com)."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.\u003c/p\u003e"
}
],
"value": "IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T17:00:50.262Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7278857"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo product patch or software update is required.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eBackground:\u003c/strong\u003e\u003cbr/\u003eThe WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eRequired Action:\u003c/strong\u003e\u003cbr/\u003eRemove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eSteps to Remove the WmServiceMock Package:\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e1. Log in to Integration Server\u00a0\u003cbr/\u003e2. Navigate to Packages \u0026gt; Management\u003cbr/\u003e3. Locate the WmServiceMock package in the package list\u003cbr/\u003e4. Click the \"Delete\" icon next to WmServiceMock\u003cbr/\u003e5. Confirm the deletion when prompted\u003cbr/\u003e6. Restart the Integration Server to complete the removal\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eFor Development/Testing Environments Only:\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eIf you must retain WmServiceMock for development or testing purposes:\u003c/p\u003e\u003cp\u003e1. Ensure the package is deployed only in isolated, non-production environments\u003cbr/\u003e2. Verify Integration Server authentication is enabled:\u003cbr/\u003e\u00a0 \u00a0- Navigate to Server \u0026gt; Ports in Integration Server\u003cbr/\u003e\u00a0 \u00a0- Review port security settings and client certificate handling\u003cbr/\u003e\u00a0 \u00a0- Confirm authentication is enforced for all ports\u003cbr/\u003e3. For detailed security configuration, refer to:\u003cbr/\u003e\u00a0 \u00a0- Integration Server Security: \u003ca href=\"https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0?topic=server-integration-security\" rel=\"nofollow\"\u003eIntegration Server Security - IBM Documentation\u003c/a\u003e\u003cbr/\u003e\u00a0 \u00a0- Configuring Port Security: \u003ca href=\"https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0?topic=ports-configuring-how-handle-client-certificates\" rel=\"nofollow\"\u003eConfiguring How Ports Handle Client Certificates - IBM Documentation\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eImportant\u003c/strong\u003e: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems.\u003c/p\u003e"
}
],
"value": "No product patch or software update is required.\n\n\n\nBackground:\nThe WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments.\n\n\n\nRequired Action:\nRemove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems.\n\n\n\nSteps to Remove the WmServiceMock Package:\n\n\n\n1. Log in to Integration Server\u00a0\n2. Navigate to Packages \u003e Management\n3. Locate the WmServiceMock package in the package list\n4. Click the \"Delete\" icon next to WmServiceMock\n5. Confirm the deletion when prompted\n6. Restart the Integration Server to complete the removal\n\n\n\nFor Development/Testing Environments Only:\n\n\n\nIf you must retain WmServiceMock for development or testing purposes:\n\n\n\n1. Ensure the package is deployed only in isolated, non-production environments\n2. Verify Integration Server authentication is enabled:\n\u00a0 \u00a0- Navigate to Server \u003e Ports in Integration Server\n\u00a0 \u00a0- Review port security settings and client certificate handling\n\u00a0 \u00a0- Confirm authentication is enforced for all ports\n3. For detailed security configuration, refer to:\n\u00a0 \u00a0- Integration Server Security: Integration Server Security - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 \n\u00a0 \u00a0- Configuring Port Security: Configuring How Ports Handle Client Certificates - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 \n\n\n\nImportant: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems."
}
],
"title": "IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-12118",
"datePublished": "2026-07-30T17:00:50.262Z",
"dateReserved": "2026-06-12T14:59:49.826Z",
"dateUpdated": "2026-07-30T17:41:17.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12118 (GCVE-0-2026-12118)
Vulnerability from cvelistv5 – Published: 2026-07-30 17:00 – Updated: 2026-07-30 17:41
VLAI
EPSS
VEX
Title
IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
Summary
IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7278857 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | webMethods Integration (on prem) |
Affected:
10.15, 10.11
cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15:*:*:*:*:*:*:* cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12118",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T17:40:56.010338Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T17:41:17.032Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15.0:*:*:*:*:*:*:*"
],
"product": "webMethods Integration (on prem)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "10.15, 10.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This vulnerability was reported to IBM by Black Lantern Security (https://www.blacklanternsecurity.com)."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.\u003c/p\u003e"
}
],
"value": "IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T17:00:50.262Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7278857"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo product patch or software update is required.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eBackground:\u003c/strong\u003e\u003cbr/\u003eThe WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eRequired Action:\u003c/strong\u003e\u003cbr/\u003eRemove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eSteps to Remove the WmServiceMock Package:\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e1. Log in to Integration Server\u00a0\u003cbr/\u003e2. Navigate to Packages \u0026gt; Management\u003cbr/\u003e3. Locate the WmServiceMock package in the package list\u003cbr/\u003e4. Click the \"Delete\" icon next to WmServiceMock\u003cbr/\u003e5. Confirm the deletion when prompted\u003cbr/\u003e6. Restart the Integration Server to complete the removal\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eFor Development/Testing Environments Only:\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eIf you must retain WmServiceMock for development or testing purposes:\u003c/p\u003e\u003cp\u003e1. Ensure the package is deployed only in isolated, non-production environments\u003cbr/\u003e2. Verify Integration Server authentication is enabled:\u003cbr/\u003e\u00a0 \u00a0- Navigate to Server \u0026gt; Ports in Integration Server\u003cbr/\u003e\u00a0 \u00a0- Review port security settings and client certificate handling\u003cbr/\u003e\u00a0 \u00a0- Confirm authentication is enforced for all ports\u003cbr/\u003e3. For detailed security configuration, refer to:\u003cbr/\u003e\u00a0 \u00a0- Integration Server Security: \u003ca href=\"https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0?topic=server-integration-security\" rel=\"nofollow\"\u003eIntegration Server Security - IBM Documentation\u003c/a\u003e\u003cbr/\u003e\u00a0 \u00a0- Configuring Port Security: \u003ca href=\"https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0?topic=ports-configuring-how-handle-client-certificates\" rel=\"nofollow\"\u003eConfiguring How Ports Handle Client Certificates - IBM Documentation\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eImportant\u003c/strong\u003e: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems.\u003c/p\u003e"
}
],
"value": "No product patch or software update is required.\n\n\n\nBackground:\nThe WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments.\n\n\n\nRequired Action:\nRemove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems.\n\n\n\nSteps to Remove the WmServiceMock Package:\n\n\n\n1. Log in to Integration Server\u00a0\n2. Navigate to Packages \u003e Management\n3. Locate the WmServiceMock package in the package list\n4. Click the \"Delete\" icon next to WmServiceMock\n5. Confirm the deletion when prompted\n6. Restart the Integration Server to complete the removal\n\n\n\nFor Development/Testing Environments Only:\n\n\n\nIf you must retain WmServiceMock for development or testing purposes:\n\n\n\n1. Ensure the package is deployed only in isolated, non-production environments\n2. Verify Integration Server authentication is enabled:\n\u00a0 \u00a0- Navigate to Server \u003e Ports in Integration Server\n\u00a0 \u00a0- Review port security settings and client certificate handling\n\u00a0 \u00a0- Confirm authentication is enforced for all ports\n3. For detailed security configuration, refer to:\n\u00a0 \u00a0- Integration Server Security: Integration Server Security - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 \n\u00a0 \u00a0- Configuring Port Security: Configuring How Ports Handle Client Certificates - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 \n\n\n\nImportant: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems."
}
],
"title": "IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-12118",
"datePublished": "2026-07-30T17:00:50.262Z",
"dateReserved": "2026-06-12T14:59:49.826Z",
"dateUpdated": "2026-07-30T17:41:17.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}