IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
Summary
| CVE | CVE-2026-12118 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-30 19:17:04 UTC |
| Updated | 2026-07-30 19:31:02 UTC |
| Description | IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-502 | CWE-502 CWE-502 Deserialization of Untrusted Data
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | IBM | WebMethods Integration On Prem | affected 10.15, 10.11 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.ibm.com/support/pages/node/7278857 | [email protected] | www.ibm.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This vulnerability was reported to IBM by Black Lantern Security (https://www.blacklanternsecurity.com). (en)
Additional Advisory Data
Solutions
CNA: No product patch or software update is required. Background: The WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments. Required Action: Remove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems. Steps to Remove the WmServiceMock Package: 1. Log in to Integration Server 2. Navigate to Packages > Management 3. Locate the WmServiceMock package in the package list 4. Click the "Delete" icon next to WmServiceMock 5. Confirm the deletion when prompted 6. Restart the Integration Server to complete the removal For Development/Testing Environments Only: If you must retain WmServiceMock for development or testing purposes: 1. Ensure the package is deployed only in isolated, non-production environments 2. Verify Integration Server authentication is enabled: - Navigate to Server > Ports in Integration Server - Review port security settings and client certificate handling - Confirm authentication is enforced for all ports 3. For detailed security configuration, refer to: - Integration Server Security: Integration Server Security - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 - Configuring Port Security: Configuring How Ports Handle Client Certificates - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 Important: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems.