EUVD-2026-51200
GHSA-9597-g68j-5wfj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network deserialization RCE (AV:N/PR:N/UI:N/AC:L) yields full code execution, so C/I/A all High; scope unchanged as impact stays within the server process.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
AnalysisAI
Remote code execution in IBM webMethods Integration (on-prem) 10.15 and 10.11 allows an unauthenticated network attacker to run arbitrary code by submitting maliciously crafted serialized data that the platform deserializes without validation (CWE-502). Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full CIA impact (9.8 Critical), exploitation requires no credentials and no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker needs network reachability to the webMethods Integration (on-prem) service that deserializes untrusted input, and the target must be running the affected 10.15 or 10.11 versions; per CVSS PR:N/UI:N no authentication or user interaction is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All raw signals point to high priority: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N means an unauthenticated, network-reachable, low-complexity attack yielding full confidentiality, integrity, and availability loss, and CWE-502 deserialization flaws are historically among the most reliably weaponized bug classes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the webMethods Integration Server over the network sends a crafted serialized (Java) object to a vulnerable listener; when the server deserializes it, a gadget chain triggers execution of attacker-controlled code in the context of the Integration Server process, requiring no credentials or user interaction. No public POC was provided in the intelligence, but the AV:N/AC:L/PR:N/UI:N profile makes reliable exploitation straightforward once a payload is developed. |
| Remediation | Apply the IBM-provided fix documented in the vendor advisory at https://www.ibm.com/support/pages/node/7278857 (Patch available per vendor advisory); the exact patched build/fix-pack version is not stated in the input data, so confirm the precise level for 10.15 and 10.11 directly from that IBM node before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems running IBM webMethods Integration versions 10.15 and 10.11, with priority flag for any internet-connected or externally exposed instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today