Security Bulletin: IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data

Summary IBM webMethods Integration Server is vulnerable to an XML external entity injection XXE attack when processing XML data. CVE-2026-2310. Vulnerability Details CVEID:CVE-2026-2310 DESCRIPTION: IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when...

Security Bulletin: Due to use bcprov-jdk18on-1.79.jar, IBM webMethods Integration Server is affected by multiple vulnerabilities.

Summary Multiple vulnerabilities were addressed in IBM webMethods Integration Server by upgrading the version of the Bouncy Castle BC-Java bcprov jar to 1.84.0 Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the...

Security Bulletin: Due to the use of mchange-commons-java, IBM webMethods BPM is vulnerable to Unsafe Reflection ( CVE-2026-55153 )

Summary IBM webMethods BPM includes the standalone utility which includes the vulnerable component mchange-commons-java. The tool operates as a standalone utility and is not part of the main runtime environments. Vulnerability Details CVEID:CVE-2026-55153 DESCRIPTION: mchange-commons-java is a Ja...

Security Bulletin: Multiple vulnerabilies in Netty impacting IBM webMethods API Management

Summary Multiple vulnerabilities in Netty have been addressed in IBM webMethods developer portal and IBM webMethods ControlPlane Vulnerability Details CVEID:CVE-2026-42579 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final,...

Security Bulletin: Multiple vulnerabilities found in spring-boot-3.3.11.jar - part of IBM webMethods API Management

Summary Multiple vulnerabilities found in spring-boot-3.3.11.jar - part of IBM webMethods API Management have been addressed Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by...

Security Bulletin: Multiple vulnerabilities found in logback-core jar which is part of IBM webMethods API Management

Summary Multiple vulnerabilities found in logback-core jar which is part of IBM webMethods API Management have been addressed Vulnerability Details CVEID:CVE-2026-1225 DESCRIPTION: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java...

Security Bulletin: Multiple vulnerabilies in Log4j impacting IBM webMethods API Management

Summary Multiple vulnerabilities in Log4j have been addressed in IBM webMethods developer portal and IBM webMethods ControlPlane Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1....

Security Bulletin: Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods API Management

Summary Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods developer portal and IBM webMethos API ControlPlane. Vulnerability Details CVEID:CVE-2026-22746 DESCRIPTION: Vulnerability in Spring Spring Security. If an application is using the...

Security Bulletin: Due to the use of Bouncy Castle Inc. BC-JAVA bcprov IBM webMethods Managed File Transfer is vulnerable to a Covert Timing Channel vulnerability and Use of a Broken or Risky Cryptographic Algorithm vulnerability

Summary Bouncy Castle Inc. BC-JAVA bcprov is used by IBM webMethods Managed File Transfer CVE-2025-14813, CVE-2026-5598, CVE-2026-0636 Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JA...

Security Bulletin: Due to the use of Netty IBM webMethods Managed File Transfer is vulnerable to Improper Access Control and Allocation of Resources without Limits or Throttling

Summary Multiple vulnerabilities in Netty used by IBM webMethods Managed File Transfer have been addressed in MAT11.1ServerFix5 and MAT12.1ServerFix1 Vulnerability Details CVEID:CVE-2026-42580 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final...

Security Bulletin: Due to the use of jackson-databind, IBM EntireX is vulnerable to multiple vulnerabilities.

Summary Due to the use of jackson-databind, IBM EntireX is vulnerable to multiple vulnerabilities CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-59888, and CVE-2026-59889. To address these vulnerabilities, the webMethods...

CVE-2026-12118

IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data...

CVE-2026-12118

IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data...

EUVD-2026-51200

IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data...

CVE-2026-12118 IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data...

CVE-2026-12118 IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data...

CVE-2026-12118

CVE-2026-12118 affects IBM webMethods Integration (on-prem) versions 10.15 and 10.11 due to deserialization of untrusted data in the bundled WmServiceMock package, allowing an unauthenticated remote attacker to execute arbitrary code. There is no product patch; remediation is to remove the WmServ...

PT-2026-66538

Name of the Vulnerable Software and Affected Versions IBM webMethods Integration on prem version 10.11 IBM webMethods Integration on prem version 10.15 Description An unauthenticated remote attacker can execute arbitrary code on the system. This is possible due to the deserialization of untrusted...

CVE-2026-12118: Deserialization of Untrusted Data

IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data...

Security Bulletin: IBM webMethods BPM is vulnerable to a denial of service due to org.eclipse.core.runtime

Summary IBM webMethods BPM uses org.eclipse.core.runtime which contains the Eclipse Workbench API classes used to create and manage workbench windows, views, editors, and perspectives. Vulnerability Details CVEID:CVE-2023-4218 DESCRIPTION: In Eclipse IDE versions 2023-09 4.29 some files with xml...