Description
IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
Published: 2026-07-30
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

No product patch or software update is required. Background: The WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments. Required Action: Remove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems. Steps to Remove the WmServiceMock Package: 1. Log in to Integration Server  2. Navigate to Packages > Management 3. Locate the WmServiceMock package in the package list 4. Click the "Delete" icon next to WmServiceMock 5. Confirm the deletion when prompted 6. Restart the Integration Server to complete the removal For Development/Testing Environments Only: If you must retain WmServiceMock for development or testing purposes: 1. Ensure the package is deployed only in isolated, non-production environments 2. Verify Integration Server authentication is enabled:    - Navigate to Server > Ports in Integration Server    - Review port security settings and client certificate handling    - Confirm authentication is enforced for all ports 3. For detailed security configuration, refer to:    - Integration Server Security: Integration Server Security - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0    - Configuring Port Security: Configuring How Ports Handle Client Certificates - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 Important: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Description IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
Title IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
First Time appeared Ibm
Ibm webmethods Integration On Prem
Weaknesses CWE-502
CPEs cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm webmethods Integration On Prem
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Webmethods Integration On Prem
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-30T17:41:17.032Z

Reserved: 2026-06-12T14:59:49.826Z

Link: CVE-2026-12118

cve-icon Vulnrichment

Updated: 2026-07-30T17:41:06.630Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data