CVE-2026-12118

CriticalCVSS 9.8

Published: 30/07/2026(UTC)Updated: 23/10/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.85%

58th percentile - higher than 58% of all known CVEs

Summary

IBM webMethods Integration (on prem) versions 10.15 and 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to deserialization of untrusted data.

Risk Assessment

An attacker can remotely execute arbitrary code on the integration server, potentially leading to full system and data compromise.

Recommendation

Apply the patch or update provided by IBM for webMethods Integration.

Other vulnerabilities in IBM webMethods Integration

CVE-2025-36072High
IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 allow an authenticated user to execute arbitrary code on the system due to deserialization of untrusted object graphs.

Original NVD description (English source)

IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS