webMethods Integration Server CVE-2026-2310

CVSS PR:L confirms that low-privileged authentication is required - the attacker must hold valid credentials to reach the Integration Server's XML-processing endpoints. No non-default configuration flag is required to enable the vulnerable code path, as XML processing is core functionality of the product. What limits exploitation: the authentication requirement (PR:L) prevents anonymous exploitation; the CVSS AV:L (Local) classification - if accurate - would additionally restrict exploitation to callers with local system access rather than network callers, which directly contradicts the description's 'remote attacker' framing; this discrepancy must be resolved with the IBM advisory before finalizing defensive posture. In environments where webMethods is behind a perimeter and accessible only to authenticated internal service accounts, the realistic attack surface is narrow.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) contains a notable internal inconsistency: the attack vector is classified as Local (AV:L) while the vulnerability description explicitly states a 'remote attacker' could exploit it - even a mid-sized municipal IT team in koszalin reviewing this advisory should verify the correct attack vector directly with IBM before scoping compensating controls, as the network-exposed surface changes urgency materially. Additionally, the Integrity impact metric (I:H) appears overstated for a standard XXE vulnerability, whose described impacts are limited to information disclosure (C:H) and memory exhaustion (A:H) - XXE does not inherently provide write primitives. No EPSS score, KEV listing, POC availability, or SSVC data was provided in the input, so exploitation urgency is assessed as low at this time. Real-world risk in enterprise deployments depends significantly on whether XML-processing endpoints are exposed to untrusted callers or sit behind authenticated API gateways and perimeter controls.

An attacker holding low-privileged credentials to the Integration Server submits a crafted XML document containing a DOCTYPE with an external entity declaration referencing a local sensitive file (e.g., <!ENTITY xxe SYSTEM 'file:///etc/passwd'>). When the Integration Server processes the XML, the unguarded parser resolves the entity and the file contents are embedded in the server's response, disclosing configuration or credential data to the attacker. Alternatively, a deeply nested recursive entity payload triggers unbounded memory expansion, crashing or severely degrading the Integration Server instance.