CVE-2025-36072

HighCVSS 8.8

Published: 20/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

39th percentile - higher than 39% of all known CVEs

Summary

IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 allow an authenticated user to execute arbitrary code on the system due to deserialization of untrusted object graphs.

Risk Assessment

An authenticated attacker could execute arbitrary code, potentially leading to full system compromise and breach of confidentiality, integrity, and availability. The risk applies to organizations using these versions.

Recommendation

Update IBM webMethods Integration to a version containing the fix (beyond the listed Core_Fix versions). Restrict authenticated user privileges to the minimum necessary.

Other vulnerabilities in IBM webMethods Integration

CVE-2026-12118Critical
IBM webMethods Integration (on prem) versions 10.15 and 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to deserialization of untrusted data.

Original NVD description (English source)

IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS