What is the CVSS score of CVE-2026-12118?

CVE-2026-12118 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of IBM webMethods Integration are affected by CVE-2026-12118?

IBM webMethods Integration on-premises installations (versions 10.15 and 10.11) are vulnerable to a critical attack that grants full system access to attackers over the network without authentication…. A patch is available.

How to fix or mitigate CVE-2026-12118?

Within 24 hours, identify and inventory all systems running IBM webMethods Integration versions 10.15 and 10.11, with priority flag for any internet-connected or externally exposed instances. Within 7 days, apply the vendor-released patch to all affected systems according to IBM guidance, testing thoroughly in non-production first. Within 30 days, verify patch application across the entire deployed base, confirm functionality post-patch, and update the asset inventory to close this vulnerability.

IBM webMethods Integration CVE-2026-12118

EUVD-2026-51200 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-30 ibm

GHSA-9597-g68j-5wfj

RCE Deserialization IBM Webmethods Integration On Prem

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network deserialization RCE (AV:N/PR:N/UI:N/AC:L) yields full code execution, so C/I/A all High; scope unchanged as impact stays within the server process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:53 vuln.today

CVE Published

Jul 30, 2026 - 17:00 cve.org

CRITICAL 9.8

DescriptionNVD

IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

AnalysisAI

Remote code execution in IBM webMethods Integration (on-prem) 10.15 and 10.11 allows an unauthenticated network attacker to run arbitrary code by submitting maliciously crafted serialized data that the platform deserializes without validation (CWE-502). Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full CIA impact (9.8 Critical), exploitation requires no credentials and no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the vendor (IBM) has released a patch, indicating a confirmed, fixable flaw.

Technical ContextAI

webMethods Integration is IBM's enterprise integration/ESB platform (Integration Server / Software AG lineage) used to build APIs, message flows, and B2B/EAI connectors, typically running on the JVM. The root cause is CWE-502, Deserialization of Untrusted Data: the application reconstructs Java objects from attacker-supplied serialized byte streams without safe type filtering, so a crafted payload can invoke gadget-chain logic during object reconstruction and reach code execution. The single CPE, cpe:2.3:a:ibm:webmethods_integration_(on_prem):*:*:*:*:*:*:*:*, scopes this to the on-premises deployment of the product rather than any managed/cloud variant. Java deserialization RCE of this class is a well-understood, high-reliability vulnerability pattern when exposed on a network-reachable listener.

RemediationAI

Apply the IBM-provided fix documented in the vendor advisory at https://www.ibm.com/support/pages/node/7278857 (Patch available per vendor advisory); the exact patched build/fix-pack version is not stated in the input data, so confirm the precise level for 10.15 and 10.11 directly from that IBM node before deploying. Until patched, reduce exposure by restricting network access to the Integration Server and its listener ports so only trusted management/integration hosts can reach it (firewall/segmentation), placing the service behind a reverse proxy or VPN, and monitoring for anomalous serialized-object traffic - with the trade-off that tightening ingress may disrupt legitimate B2B/partner connections that rely on those endpoints. If IBM's advisory specifies a JVM deserialization filter or configuration hardening step, apply it as an interim compensating control.