CVE-2026-12118

IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7278857	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:webmethods_integration:10.11:::::::*
	cpe:2.3:a:ibm:webmethods_integration:10.15:::::::*

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) IBM webMethods Integration (on prem) 10.15, 10.11 podría permitir a un atacante remoto no autenticado ejecutar código arbitrario en el sistema debido a la deserialización de datos no confiables.

Information

Published : 2026-07-30 19:17

Updated : 2026-10-23 22:10

NVD link : CVE-2026-12118

Mitre link : CVE-2026-12118

CVE.ORG link : CVE-2026-12118

JSON object : View

Products Affected

ibm

webmethods_integration

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-12118", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12118", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-30T17:40:56.010338Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "webMethods Integration (on prem)", "versions": [{"status": "affected", "version": "10.15, 10.11"}]}]}], "published": "2026-07-30T19:17:04.483", "references": [{"url": "https://www.ibm.com/support/pages/node/7278857", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data."}, {"lang": "es", "value": "IBM webMethods Integration (on prem) 10.15, 10.11 podr\u00eda permitir a un atacante remoto no autenticado ejecutar c\u00f3digo arbitrario en el sistema debido a la deserializaci\u00f3n de datos no confiables."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:webmethods_integration:10.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2008B366-18FC-4991-976F-4CE78FE52B55"}, {"criteria": "cpe:2.3:a:ibm:webmethods_integration:10.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A74F598F-90A3-4F57-99B8-5BA7AD731699"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}