CVE-2026-12118

IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

Affected

IBM · webMethods Integration (on prem)

CVSS v3.1 IBM

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.85% chance of exploitation in the next 30 days, 57th percentile

Published

2026-07-30

Proof-of-concept exploits (1)

• uday952/CVE-2026-12118-POC-0★ · 2026-10-15

Security advisories

• https://www.ibm.com/support/pages/node/7278857

References

• CVE Record
• NVD entry

Related

• CVE-2026-104711