Webmethods Integration On Prem
Monthly
Remote code execution in IBM webMethods Integration (on-prem) 10.15 and 10.11 allows an unauthenticated network attacker to run arbitrary code by submitting maliciously crafted serialized data that the platform deserializes without validation (CWE-502). Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full CIA impact (9.8 Critical), exploitation requires no credentials and no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the vendor (IBM) has released a patch, indicating a confirmed, fixable flaw.
Remote code execution in IBM webMethods Integration (on-prem) 10.15 and 10.11 allows an unauthenticated network attacker to run arbitrary code by submitting maliciously crafted serialized data that the platform deserializes without validation (CWE-502). Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full CIA impact (9.8 Critical), exploitation requires no credentials and no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the vendor (IBM) has released a patch, indicating a confirmed, fixable flaw.