CVE-2026-12118
IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
02 Description
IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 0.84% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 57.8% of scored records. A rank, not a probability.
- NVD base score
- 9.8 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVD analysis status
- Analyzed. NVD last modified this record on 2026-10-23.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-07-30 17:00Z3 MO AGO
- Last updated
- 2026-07-30 17:41Z3 MO AGO
- Reserved
- 2026-06-12
- Assigning CNA
- ibm
- Record state
- PUBLISHED
- Severity
- Critical (CVSS 9.8)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502Deserialization of Untrusted DataBase
- Data version
- 5.2
- Document digest
- 8e6a05988652cccff564ff16a09e4dd706b3112beb30b702be0d2ddb826fc741
05 Affected products
06 References
07 Remediation
No product patch or software update is required. Background: The WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments. Required Action: Remove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems. Steps to Remove the WmServiceMock Package: 1. Log in to Integration Server 2. Navigate to Packages > Management 3. Locate the WmServiceMock package in the package list 4. Click the "Delete" icon next to WmServiceMock 5. Confirm the deletion when prompted 6. Restart the Integration Server to complete the removal For Development/Testing Environments Only: If you must retain WmServiceMock for development or testing purposes: 1. Ensure the package is deployed only in isolated, non-production environments 2. Verify Integration Server authentication is enabled: - Navigate to Server > Ports in Integration Server - Review port security settings and client certificate handling - Confirm authentication is enforced for all ports 3. For detailed security configuration, refer to: - Integration Server Security: Integration Server Security - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 - Configuring Port Security: Configuring How Ports Handle Client Certificates -