CVE-2026-12118CWE-502insecure-deserialization

CVE-2026-12118

Critical · published July 30, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00849 · 57.7th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-07-30T23:17Z
Affected products (2)
ProductVersionsFixed in
ibm/webmethods_integrationall versions—
ibm/webmethods_integrationall versions—
References (1)
https://www.ibm.com/support/pages/node/7278857 · [email protected]
EPSS history
Timeline
  • 30 JUL 17:00Z
    IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
    cvelistv5