Vulnerability-Lookup

CVE-2026-12118 (GCVE-0-2026-12118)

Vulnerability from cvelistv5 – Published: 2026-07-30 17:00 – Updated: 2026-07-30 17:41

Title

IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

Summary

IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

ibm

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7278857	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	webMethods Integration (on prem)	Affected: 10.15, 10.11 cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15:::::::* cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15.0:::::::*

Credits

This vulnerability was reported to IBM by Black Lantern Security (https://www.blacklanternsecurity.com).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12118",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T17:40:56.010338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T17:41:17.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15.0:*:*:*:*:*:*:*"
          ],
          "product": "webMethods Integration (on prem)",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "10.15, 10.11"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability was reported to IBM by Black Lantern Security (https://www.blacklanternsecurity.com)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.\u003c/p\u003e"
            }
          ],
          "value": "IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T17:00:50.262Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7278857"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNo product patch or software update is required.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eBackground:\u003c/strong\u003e\u003cbr/\u003eThe WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eRequired Action:\u003c/strong\u003e\u003cbr/\u003eRemove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eSteps to Remove the WmServiceMock Package:\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e1. Log in to Integration Server\u00a0\u003cbr/\u003e2. Navigate to Packages \u0026gt; Management\u003cbr/\u003e3. Locate the WmServiceMock package in the package list\u003cbr/\u003e4. Click the \"Delete\" icon next to WmServiceMock\u003cbr/\u003e5. Confirm the deletion when prompted\u003cbr/\u003e6. Restart the Integration Server to complete the removal\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eFor Development/Testing Environments Only:\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eIf you must retain WmServiceMock for development or testing purposes:\u003c/p\u003e\u003cp\u003e1. Ensure the package is deployed only in isolated, non-production environments\u003cbr/\u003e2. Verify Integration Server authentication is enabled:\u003cbr/\u003e\u00a0 \u00a0- Navigate to Server \u0026gt; Ports in Integration Server\u003cbr/\u003e\u00a0 \u00a0- Review port security settings and client certificate handling\u003cbr/\u003e\u00a0 \u00a0- Confirm authentication is enforced for all ports\u003cbr/\u003e3. For detailed security configuration, refer to:\u003cbr/\u003e\u00a0 \u00a0- Integration Server Security: \u003ca href=\"https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0?topic=server-integration-security\" rel=\"nofollow\"\u003eIntegration Server Security - IBM Documentation\u003c/a\u003e\u003cbr/\u003e\u00a0 \u00a0- Configuring Port Security: \u003ca href=\"https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0?topic=ports-configuring-how-handle-client-certificates\" rel=\"nofollow\"\u003eConfiguring How Ports Handle Client Certificates - IBM Documentation\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eImportant\u003c/strong\u003e: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems.\u003c/p\u003e"
            }
          ],
          "value": "No product patch or software update is required.\n\n\n\nBackground:\nThe WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments.\n\n\n\nRequired Action:\nRemove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems.\n\n\n\nSteps to Remove the WmServiceMock Package:\n\n\n\n1. Log in to Integration Server\u00a0\n2. Navigate to Packages \u003e Management\n3. Locate the WmServiceMock package in the package list\n4. Click the \"Delete\" icon next to WmServiceMock\n5. Confirm the deletion when prompted\n6. Restart the Integration Server to complete the removal\n\n\n\nFor Development/Testing Environments Only:\n\n\n\nIf you must retain WmServiceMock for development or testing purposes:\n\n\n\n1. Ensure the package is deployed only in isolated, non-production environments\n2. Verify Integration Server authentication is enabled:\n\u00a0 \u00a0- Navigate to Server \u003e Ports in Integration Server\n\u00a0 \u00a0- Review port security settings and client certificate handling\n\u00a0 \u00a0- Confirm authentication is enforced for all ports\n3. For detailed security configuration, refer to:\n\u00a0 \u00a0- Integration Server Security:  Integration Server Security - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 \n\u00a0 \u00a0- Configuring Port Security:  Configuring How Ports Handle Client Certificates - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 \n\n\n\nImportant: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems."
        }
      ],
      "title": "IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-12118",
    "datePublished": "2026-07-30T17:00:50.262Z",
    "dateReserved": "2026-06-12T14:59:49.826Z",
    "dateUpdated": "2026-07-30T17:41:17.032Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-12118",
      "date": "2026-07-31",
      "epss": "0.00499",
      "percentile": "0.4001"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-12118\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2026-07-30T19:17:04.483\",\"lastModified\":\"2026-07-30T19:31:02.643\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.\"}],\"affected\":[{\"source\":\"psirt@us.ibm.com\",\"affectedData\":[{\"vendor\":\"IBM\",\"product\":\"webMethods Integration (on prem)\",\"cpes\":[\"cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15.0:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"10.15, 10.11\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-30T17:40:56.010338Z\",\"id\":\"CVE-2026-12118\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7278857\",\"source\":\"psirt@us.ibm.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-12118\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-30T17:40:56.010338Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-30T17:41:06.630Z\"}}], \"cna\": {\"title\": \"IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This vulnerability was reported to IBM by Black Lantern Security (https://www.blacklanternsecurity.com).\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15.0:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"webMethods Integration (on prem)\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.15, 10.11\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"No product patch or software update is required.\\n\\n\\n\\nBackground:\\nThe WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments.\\n\\n\\n\\nRequired Action:\\nRemove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems.\\n\\n\\n\\nSteps to Remove the WmServiceMock Package:\\n\\n\\n\\n1. Log in to Integration Server\\u00a0\\n2. Navigate to Packages \u003e Management\\n3. Locate the WmServiceMock package in the package list\\n4. Click the \\\"Delete\\\" icon next to WmServiceMock\\n5. Confirm the deletion when prompted\\n6. Restart the Integration Server to complete the removal\\n\\n\\n\\nFor Development/Testing Environments Only:\\n\\n\\n\\nIf you must retain WmServiceMock for development or testing purposes:\\n\\n\\n\\n1. Ensure the package is deployed only in isolated, non-production environments\\n2. Verify Integration Server authentication is enabled:\\n\\u00a0 \\u00a0- Navigate to Server \u003e Ports in Integration Server\\n\\u00a0 \\u00a0- Review port security settings and client certificate handling\\n\\u00a0 \\u00a0- Confirm authentication is enforced for all ports\\n3. For detailed security configuration, refer to:\\n\\u00a0 \\u00a0- Integration Server Security:  Integration Server Security - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 \\n\\u00a0 \\u00a0- Configuring Port Security:  Configuring How Ports Handle Client Certificates - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 \\n\\n\\n\\nImportant: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eNo product patch or software update is required.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eBackground:\u003c/strong\u003e\u003cbr/\u003eThe WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eRequired Action:\u003c/strong\u003e\u003cbr/\u003eRemove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eSteps to Remove the WmServiceMock Package:\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e1. Log in to Integration Server\\u00a0\u003cbr/\u003e2. Navigate to Packages \u0026gt; Management\u003cbr/\u003e3. Locate the WmServiceMock package in the package list\u003cbr/\u003e4. Click the \\\"Delete\\\" icon next to WmServiceMock\u003cbr/\u003e5. Confirm the deletion when prompted\u003cbr/\u003e6. Restart the Integration Server to complete the removal\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eFor Development/Testing Environments Only:\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eIf you must retain WmServiceMock for development or testing purposes:\u003c/p\u003e\u003cp\u003e1. Ensure the package is deployed only in isolated, non-production environments\u003cbr/\u003e2. Verify Integration Server authentication is enabled:\u003cbr/\u003e\\u00a0 \\u00a0- Navigate to Server \u0026gt; Ports in Integration Server\u003cbr/\u003e\\u00a0 \\u00a0- Review port security settings and client certificate handling\u003cbr/\u003e\\u00a0 \\u00a0- Confirm authentication is enforced for all ports\u003cbr/\u003e3. For detailed security configuration, refer to:\u003cbr/\u003e\\u00a0 \\u00a0- Integration Server Security: \u003ca href=\\\"https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0?topic=server-integration-security\\\" rel=\\\"nofollow\\\"\u003eIntegration Server Security - IBM Documentation\u003c/a\u003e\u003cbr/\u003e\\u00a0 \\u00a0- Configuring Port Security: \u003ca href=\\\"https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0?topic=ports-configuring-how-handle-client-certificates\\\" rel=\\\"nofollow\\\"\u003eConfiguring How Ports Handle Client Certificates - IBM Documentation\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eImportant\u003c/strong\u003e: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7278857\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of Untrusted Data\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-07-30T17:00:50.262Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-12118\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-30T17:41:17.032Z\", \"dateReserved\": \"2026-06-12T14:59:49.826Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-07-30T17:00:50.262Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-12118 (GCVE-0-2026-12118)

GHSA-9597-G68J-5WFJ

Tags

Sightings

Nomenclature