CVE-2025-36049: IBM Webmethods Integration

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands.

Affected products

• IBM Webmethods Integration: version 10.5 only; version 10.7 only; version 10.11 only; version 10.15 only

Published 2025-06-18. Last modified 2026-06-17.