{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12118", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-06-12T14:59:49.826Z", "datePublished": "2026-07-30T17:00:50.262Z", "dateUpdated": "2026-07-30T17:41:17.032Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-07-30T17:00:50.262Z"}, "title": "IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "webMethods Integration (on prem)", "versions": [{"status": "affected", "version": "10.15, 10.11"}], "cpes": ["cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:webmethods_integration_on_prem:10.15.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7278857", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "No product patch or software update is required.\n\n\n\nBackground:\nThe WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments.\n\n\n\nRequired Action:\nRemove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems.\n\n\n\nSteps to Remove the WmServiceMock Package:\n\n\n\n1. Log in to Integration Server\u00a0\n2. Navigate to Packages > Management\n3. Locate the WmServiceMock package in the package list\n4. Click the \"Delete\" icon next to WmServiceMock\n5. Confirm the deletion when prompted\n6. Restart the Integration Server to complete the removal\n\n\n\nFor Development/Testing Environments Only:\n\n\n\nIf you must retain WmServiceMock for development or testing purposes:\n\n\n\n1. Ensure the package is deployed only in isolated, non-production environments\n2. Verify Integration Server authentication is enabled:\n\u00a0 \u00a0- Navigate to Server > Ports in Integration Server\n\u00a0 \u00a0- Review port security settings and client certificate handling\n\u00a0 \u00a0- Confirm authentication is enforced for all ports\n3. For detailed security configuration, refer to:\n\u00a0 \u00a0- Integration Server Security: Integration Server Security - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 \n\u00a0 \u00a0- Configuring Port Security: Configuring How Ports Handle Client Certificates - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0 \n\n\n\nImportant: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>No product patch or software update is required.</p><p><strong>Background:</strong><br/>The WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments.</p><p><strong>Required Action:</strong><br/>Remove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems.</p><p><strong>Steps to Remove the WmServiceMock Package:</strong></p><p>1. Log in to Integration Server\u00a0<br/>2. Navigate to Packages &gt; Management<br/>3. Locate the WmServiceMock package in the package list<br/>4. Click the \"Delete\" icon next to WmServiceMock<br/>5. Confirm the deletion when prompted<br/>6. Restart the Integration Server to complete the removal</p><p><strong>For Development/Testing Environments Only:</strong></p><p>If you must retain WmServiceMock for development or testing purposes:</p><p>1. Ensure the package is deployed only in isolated, non-production environments<br/>2. Verify Integration Server authentication is enabled:<br/>\u00a0 \u00a0- Navigate to Server &gt; Ports in Integration Server<br/>\u00a0 \u00a0- Review port security settings and client certificate handling<br/>\u00a0 \u00a0- Confirm authentication is enforced for all ports<br/>3. For detailed security configuration, refer to:<br/>\u00a0 \u00a0- Integration Server Security: <a href=\"https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0?topic=server-integration-security\" rel=\"nofollow\">Integration Server Security - IBM Documentation</a><br/>\u00a0 \u00a0- Configuring Port Security: <a href=\"https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0?topic=ports-configuring-how-handle-client-certificates\" rel=\"nofollow\">Configuring How Ports Handle Client Certificates - IBM Documentation</a></p><p><strong>Important</strong>: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems.</p>"}]}], "credits": [{"lang": "en", "value": "This vulnerability was reported to IBM by Black Lantern Security (https://www.blacklanternsecurity.com).", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-30T17:40:56.010338Z", "id": "CVE-2026-12118", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T17:41:17.032Z"}}]}}

{}

{}

{}

{}