CVE-2026-12118

CRITICAL

IBM webMethods Integration 10.11/10.15 - Unauthenticated Remote Code Execution

Title source: manual

Description

IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory patch

https://www.ibm.com/support/pages/node/7278857

Scores

CVSS v3 9.8

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-502

Status published

Products (1)

IBM/webMethods Integration (on prem) 10.15, 10.11

Published Jul 30, 2026

Tracked Since Jul 30, 2026